[AZ-284] Autodev baseline + testability refactor

Phase A baseline outputs from /autodev (Steps 1-5):
- Problem & solution docs (_docs/00_problem, _docs/01_solution)
- Codebase documentation (_docs/02_document) incl. architecture,
  module-layout, glossary, system-flows, baseline compliance scan
- Test specs (blackbox, performance, resilience, security, resource,
  traceability matrix)
- Test task decomposition (_docs/02_tasks/todo): AZ-285..AZ-290
- Testability refactor (_docs/04_refactoring/01-testability-refactoring):
  - TC-01 Move DownloadedTileInfoV2 + new ExistingTileInfo to Common.DTO
  - TC-02 Replace dead ISatelliteDownloader API with real signatures
  - TC-03 GoogleMapsDownloaderV2 implements ISatelliteDownloader
  - TC-04 TileService depends on ISatelliteDownloader (mockable)
  - TC-05 DI + endpoints use ISatelliteDownloader
- Test runner scripts (scripts/run-tests.sh, run-performance-tests.sh)
- Autodev state pointer (_docs/_autodev_state.md)

Prepares the codebase for AZ-285..AZ-290 unit/integration test work.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_document/modules/api_program.md

@@ -0,0 +1,88 @@
+# Module: Api/Program.cs
+
+## Purpose
+Application entry point. Configures DI container, sets up middleware, defines minimal API endpoints, runs database migrations on startup, and starts background services.
+
+## Public Interface
+
+### API Endpoints
+| Method | Route | Handler | Description |
+|--------|-------|---------|-------------|
+| GET | `/tiles/{z}/{x}/{y}` | `ServeTile` | Slippy map tile server with in-memory caching |
+| GET | `/api/satellite/tiles/latlon` | `GetTileByLatLon` | Download single tile by lat/lon/zoom |
+| GET | `/api/satellite/tiles/mgrs` | `GetSatelliteTilesByMgrs` | MGRS stub (returns empty) |
+| POST | `/api/satellite/upload` | `UploadImage` | Image upload stub (returns `Success: false`) |
+| POST | `/api/satellite/request` | `RequestRegion` | Queue region for async tile processing |
+| GET | `/api/satellite/region/{id}` | `GetRegionStatus` | Get region processing status |
+| POST | `/api/satellite/route` | `CreateRoute` | Create route with intermediate points |
+| GET | `/api/satellite/route/{id}` | `GetRoute` | Get route with all points |
+
+### Local Records (defined in Program.cs)
+- `GetSatelliteTilesResponse`, `SatelliteTile` — MGRS response stubs
+- `UploadImageRequest` — multipart form data request
+- `SaveResult` — upload response stub
+- `DownloadTileResponse` — tile download response
+- `RequestRegionRequest` — region request body
+- `ParameterDescriptionFilter` — Swagger operation filter
+
+## Internal Logic
+
+### DI Registration
+1. Serilog configured from `appsettings.json`
+2. Connection string extracted from `ConnectionStrings:DefaultConnection`
+3. Config bindings: `MapConfig`, `StorageConfig`, `ProcessingConfig`
+4. Singletons: repositories (`TileRepository`, `RegionRepository`, `RouteRepository`), `GoogleMapsDownloaderV2`, `ITileService`, `IRegionService`, `IRouteService`
+5. `IRegionRequestQueue` with configurable capacity
+6. Hosted services: `RegionProcessingService`, `RouteProcessingService`
+7. CORS policy: `TilesCors` — configured origins from `CorsConfig:AllowedOrigins`, falls back to allow-any
+8. JSON options: camelCase, case-insensitive
+
+### Startup
+1. Database migration via `DatabaseMigrator.RunMigrations()` — throws on failure
+2. Creates tiles and ready directories
+3. Swagger enabled in Development mode
+4. HTTPS redirection, CORS applied
+
+### ServeTile Handler
+1. Checks `IMemoryCache` for tile bytes (1h absolute, 30min sliding expiration)
+2. If cache miss: queries `ITileRepository.GetByTileCoordinatesAsync`
+3. If no DB record: downloads tile via `GoogleMapsDownloaderV2.DownloadSingleTileAsync`, creates `TileEntity`, inserts
+4. Returns image bytes with cache headers (`Cache-Control: public, max-age=86400`)
+
+### GetTileByLatLon Handler
+Downloads a tile, persists it, returns metadata as `DownloadTileResponse`.
+
+### RequestRegion Handler
+Validates size (100–10000m), delegates to `IRegionService.RequestRegionAsync`.
+
+## Dependencies
+All project references: Common, DataAccess, Services.
+NuGet: `Serilog.AspNetCore`, `Swashbuckle.AspNetCore`, `Microsoft.AspNetCore.OpenApi`, `SixLabors.ImageSharp`, `Newtonsoft.Json`.
+
+## Consumers
+- HTTP clients (external)
+- Integration tests (via HTTP)
+
+## Data Models
+Defines several local request/response records that are not shared with other projects.
+
+## Configuration
+All configuration sections are consumed here:
+- `ConnectionStrings:DefaultConnection`
+- `MapConfig`, `StorageConfig`, `ProcessingConfig`
+- `CorsConfig:AllowedOrigins`
+- `Serilog` section
+
+## External Integrations
+- Google Maps (indirectly via `GoogleMapsDownloaderV2`)
+- PostgreSQL (via repositories and DatabaseMigrator)
+- File system (`./tiles/`, `./ready/`)
+
+## Security
+- CORS configured (permissive by default when no origins specified)
+- Swagger only in Development
+- HTTPS redirection enabled
+- No authentication/authorization implemented
+
+## Tests
+Integration tests exercise all endpoints. Unit test project has only a dummy test.