Rewrite the gateway around health, retries, slicing and a Windows service

Scanner
- manifest lookup is now depth-bounded and prunes numeric zoom directories, so
  a scan no longer walks the whole tile payload
- rescans only report a version as updated when something actually changed
- overlapping runs are refused instead of interleaving their bookkeeping

Hot path
- token authorisation loads only that token grants and throttles the
  last_used_at write instead of touching it on every tile
- SQLite runs in WAL with a busy timeout and a real connection pool
- the catalog lookup used by /tiles no longer loads every basemap

Security
- the admin surface requires ADMIN_TOKEN (bearer) or ADMIN_USER/ADMIN_PASSWORD
  (basic), and the service refuses to bind off-host without credentials
- CORS is an explicit allow-list; newly minted tokens never reach a redirect URL
- client tokens are redacted from the access log

Operations
- resource health inspection flags a moved or deleted tile root before a 404
- pushes retry with backoff and can be re-queued by hand; the schedule lives in
  the database so a restart does not lose it
- access log plus /metrics counters

Image slicing
- tile_jobs drive the GDAL bundled with QGIS via scripts/gdal2tiles-qgis.bat
- layer_sources remembers what a layer is made of: submit one source to append
  a flight, or all of them to rebuild the layer as a VRT mosaic with no tile
  seams; the console exposes both, including a one-click rebuild
- slicing is available to integrations through a narrow slice token scope
  (submit, poll, idempotent by code, completion callback)

Console
- rebuilt around a fixed rail and single-view navigation with health and
  outstanding work leading, instead of one long scrolling page

Windows service
- native install/start/stop/status with crash recovery, auto-start and a
  rotating log file, so no NSSM wrapper is needed
- start-all.bat and stop-all.bat are removed: they killed the process by port
  with taskkill, which fought the service restart policy

Verified with 49 tests and live runs against real tile data and real GDAL.

.gitignore

@@ -1,32 +1,31 @@
-# Local machine configuration
-config/service.env
-
-# Runtime data and generated assets
+# --- Runtime data (never commit) -------------------------------------------
+# data/ holds the production SQLite catalog, the tile tree and the vector
+# assets. It is machine state, not source.
 data/
-logs/
-temp/
-.tmp/
 
-# Go local caches
+# --- Build and toolchain caches --------------------------------------------
 .gocache/
 .gomodcache/
-.gotmp/
 .gopath/
+.gotmp/
+bin/
+temp/
+.tmp/
+logs/
 
-# Python cache
+# --- Machine-specific config -----------------------------------------------
+# config/service.env carries absolute paths for one machine; the .example file
+# is the template to copy from.
+config/service.env
+
+# --- Tooling artifacts ------------------------------------------------------
+.claude/
+.codex/
+.impeccable/
 __pycache__/
 *.pyc
-*.pyo
 
-# Build and test artifacts
-*.exe
-*.test
-*.out
-*.err
-*.log
-*.pid
-coverage.out
-
-# OS / editor noise
-.DS_Store
+# --- OS/editor noise --------------------------------------------------------
 Thumbs.db
+Desktop.ini
+*.swp