[AZ-284] Autodev baseline + testability refactor

Phase A baseline outputs from /autodev (Steps 1-5):
- Problem & solution docs (_docs/00_problem, _docs/01_solution)
- Codebase documentation (_docs/02_document) incl. architecture,
  module-layout, glossary, system-flows, baseline compliance scan
- Test specs (blackbox, performance, resilience, security, resource,
  traceability matrix)
- Test task decomposition (_docs/02_tasks/todo): AZ-285..AZ-290
- Testability refactor (_docs/04_refactoring/01-testability-refactoring):
  - TC-01 Move DownloadedTileInfoV2 + new ExistingTileInfo to Common.DTO
  - TC-02 Replace dead ISatelliteDownloader API with real signatures
  - TC-03 GoogleMapsDownloaderV2 implements ISatelliteDownloader
  - TC-04 TileService depends on ISatelliteDownloader (mockable)
  - TC-05 DI + endpoints use ISatelliteDownloader
- Test runner scripts (scripts/run-tests.sh, run-performance-tests.sh)
- Autodev state pointer (_docs/_autodev_state.md)

Prepares the codebase for AZ-285..AZ-290 unit/integration test work.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_tasks/todo/AZ-290_nonfunctional_tests.md

@@ -0,0 +1,50 @@
+# Non-Functional Tests
+
+**Task**: AZ-290_nonfunctional_tests
+**Name**: Non-functional tests: perf, resilience, security, limits
+**Complexity**: 3 points
+**Dependencies**: AZ-285
+**Component**: Blackbox Tests
+**Tracker**: AZ-290
+**Epic**: AZ-284
+
+## Performance Scenarios (PT-01 through PT-06)
+
+- PT-01: Tile download latency <30s
+- PT-02: Cached tile retrieval <500ms
+- PT-03/04: Region processing throughput
+- PT-05: 5 concurrent regions all complete
+- PT-06: Route interpolation <5s
+
+## Resilience Scenarios (RS-01 through RS-06)
+
+- RS-01: API starts with database ready
+- RS-02: Migrations run on fresh DB
+- RS-03: Region processing handles tile failures
+- RS-04: Queue rejects overflow (capacity 1000)
+- RS-05: Max 4 concurrent downloads
+- RS-06: Route processing completes all regions
+
+## Security Scenarios (SEC-01 through SEC-04)
+
+- SEC-01: SQL injection via coordinates
+- SEC-02: Path traversal in tile serving
+- SEC-03: Oversized region request
+- SEC-04: Malformed JSON
+
+## Resource Limit Scenarios (RL-01 through RL-04)
+
+- RL-01: ZIP ≤ 50MB
+- RL-02: Queue capacity 1000
+- RL-03: Concurrent download semaphore (4)
+- RL-04: Concurrent region processing (20)
+
+## System Under Test Boundary
+
+All tests drive the system via HTTP API or observe Docker container behavior.
+
+## Acceptance Criteria
+
+AC-1: Performance scripts (scripts/run-performance-tests.sh) pass thresholds
+AC-2: Resilience tests verify state transitions and resource limits
+AC-3: Security tests confirm no injection or traversal vulnerabilities