[AZ-505] Tile inventory endpoint + HTTP/2 + Leaflet covering index

Production code:
- POST /api/satellite/tiles/inventory (XOR body, 5000-cap,
  most-recent-per-location_hash select, present/absent shaping).
- Kestrel HttpProtocols.Http1AndHttp2 on every listener (AC-5).
- Migration 015 creates tiles_leaflet_path covering index over
  (location_hash, captured_at DESC, updated_at DESC, id DESC)
  INCLUDE (file_path, source); drops superseded idx_tiles_location_hash.
- TileRepository.GetByTileCoordinatesAsync rewired to filter by
  location_hash (Index Only Scan via tiles_leaflet_path).
- TileRepository.GetTilesByLocationHashesAsync added with Npgsql-
  direct ANY($1::uuid[]) binding (Dapper IEnumerable expansion is
  incompatible with the array form).
- Uuidv5.LocationHashForTile centralises the UUIDv5(TileNamespace,
  "{z}/{x}/{y}") formula — single source of truth for the cross-repo
  invariant (gps-denied-onboard parity).

Contracts:
- New: contracts/api/tile-inventory.md v1.0.0.
- Bumped: contracts/data-access/tile-storage.md to v2.0.0 (joint
  ownership by AZ-503-foundation + AZ-505: schema + covering index +
  GetByTileCoordinatesAsync rewrite).

Tests:
- TileInventoryTests covers AC-1, AC-2 (DB-level), AC-4, AC-6.
- Http2MultiplexingTests covers AC-5 (20 concurrent multiplexed GETs
  over h2c via SocketsHttpHandler + AppContext Http2Unencrypted switch).
- LeafletPathIndexOnlyTests covers AC-3 (EXPLAIN (ANALYZE, BUFFERS)
  asserts Index Only Scan over tiles_leaflet_path with heap_blocks=0).

Docs:
- architecture.md, system-flows.md, data_model.md, module-layout.md,
  glossary.md, modules/api_program.md, modules/dataaccess_tile_repository.md,
  components/02_data_access/description.md all updated to reference the
  v2.0.0 tile-storage contract + new tile-inventory contract + AC-7.

Reports:
- batch_01_cycle6_report.md, batch_01_cycle6_review.md,
  implementation_completeness_cycle6_report.md (PASS),
  implementation_report_tile_inventory_cycle6.md.

Task spec moved todo/ -> done/.

Co-authored-by: Cursor <cursoragent@cursor.com>

SatelliteProvider.IntegrationTests/Http2MultiplexingTests.cs

@@ -0,0 +1,112 @@
+using System.Net;
+using System.Net.Http.Headers;
+
+namespace SatelliteProvider.IntegrationTests;
+
+// AZ-505 AC-5: HTTP/2 multiplexed responses on the dev plaintext endpoint.
+//
+// Kestrel is configured with `HttpProtocols.Http1AndHttp2` (Program.cs); the
+// .NET HttpClient supports HTTP/2 over plaintext (h2c, prior-knowledge) when
+// the `System.Net.SocketsHttpHandler.Http2UnencryptedSupport` AppContext switch
+// is on. Browsers cannot use h2c — that's documented in the AZ-505 risk
+// section and in `tile-inventory.md` v1.0.0. This test exercises the
+// programmatic-client path the onboard `TileDownloader` (httpx http2=True)
+// uses in production.
+public static class Http2MultiplexingTests
+{
+    private const int ConcurrentRequestCount = 20;
+
+    public static async Task RunAll(string apiUrl, string secret)
+    {
+        RouteTestHelpers.PrintTestHeader("Test: HTTP/2 multiplexing on /tiles/{z}/{x}/{y} (AZ-505)");
+
+        // The Http2UnencryptedSupport switch is process-wide on the client.
+        // Setting it more than once is a no-op, so it's safe to call here even
+        // though other tests in the same runner do not need it.
+        AppContext.SetSwitch("System.Net.SocketsHttpHandler.Http2UnencryptedSupport", true);
+
+        var apiUri = new Uri(apiUrl);
+        using var handler = new SocketsHttpHandler
+        {
+            // AC-5 requires the responses to multiplex on a SINGLE TCP
+            // connection. Limiting the connection pool to 1 forces this.
+            PooledConnectionLifetime = TimeSpan.FromMinutes(2),
+            EnableMultipleHttp2Connections = false
+        };
+
+        using var client = new HttpClient(handler)
+        {
+            BaseAddress = apiUri,
+            Timeout = TimeSpan.FromMinutes(1),
+            DefaultRequestVersion = HttpVersion.Version20,
+            DefaultVersionPolicy = HttpVersionPolicy.RequestVersionExact
+        };
+        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
+            "Bearer",
+            JwtTestHelpers.MintAuthenticated(secret));
+
+        // Pick a single (z, x, y) — caching means all 20 calls hit the same
+        // tile, which is exactly what we want: prove the responses come back
+        // over HTTP/2 with their CDN-style headers preserved.
+        const int z = 18;
+        const int x = 154321;
+        const int y = 95812;
+        var path = $"/tiles/{z}/{x}/{y}";
+
+        // Prime the cache with a single warm-up call so the 20 concurrent
+        // calls don't pay the GoogleMaps download cost.
+        var warmup = await client.GetAsync(path);
+        await EnsureSuccess(warmup, "AC-5 warmup");
+
+        var concurrentTasks = Enumerable.Range(0, ConcurrentRequestCount)
+            .Select(_ => client.GetAsync(path))
+            .ToArray();
+        var responses = await Task.WhenAll(concurrentTasks);
+
+        try
+        {
+            for (var i = 0; i < responses.Length; i++)
+            {
+                var response = responses[i];
+                if (response.StatusCode != HttpStatusCode.OK)
+                {
+                    throw new Exception($"AC-5: response {i} expected HTTP 200, got HTTP {(int)response.StatusCode}");
+                }
+                if (response.Version != HttpVersion.Version20)
+                {
+                    throw new Exception($"AC-5: response {i} expected HTTP/2.0, got HTTP/{response.Version}");
+                }
+                if (response.Headers.ETag is null)
+                {
+                    throw new Exception($"AC-5: response {i} is missing the ETag header — header preservation regressed.");
+                }
+                if (response.Headers.CacheControl is null)
+                {
+                    throw new Exception($"AC-5: response {i} is missing the Cache-Control header — header preservation regressed.");
+                }
+            }
+        }
+        finally
+        {
+            foreach (var r in responses)
+            {
+                r.Dispose();
+            }
+        }
+
+        Console.WriteLine($"  ✓ All {ConcurrentRequestCount} concurrent GETs returned HTTP/2.0 with preserved ETag + Cache-Control");
+    }
+
+    private static async Task EnsureSuccess(HttpResponseMessage response, string label)
+    {
+        if (!response.IsSuccessStatusCode)
+        {
+            var body = await response.Content.ReadAsStringAsync();
+            throw new Exception($"{label}: expected success, got HTTP {(int)response.StatusCode}. Body: {body}");
+        }
+        if (response.Version != HttpVersion.Version20)
+        {
+            throw new Exception($"{label}: expected HTTP/2 even on warmup, got HTTP/{response.Version}");
+        }
+    }
+}