Rewrite the gateway around health, retries, slicing and a Windows service

Scanner
- manifest lookup is now depth-bounded and prunes numeric zoom directories, so
  a scan no longer walks the whole tile payload
- rescans only report a version as updated when something actually changed
- overlapping runs are refused instead of interleaving their bookkeeping

Hot path
- token authorisation loads only that token grants and throttles the
  last_used_at write instead of touching it on every tile
- SQLite runs in WAL with a busy timeout and a real connection pool
- the catalog lookup used by /tiles no longer loads every basemap

Security
- the admin surface requires ADMIN_TOKEN (bearer) or ADMIN_USER/ADMIN_PASSWORD
  (basic), and the service refuses to bind off-host without credentials
- CORS is an explicit allow-list; newly minted tokens never reach a redirect URL
- client tokens are redacted from the access log

Operations
- resource health inspection flags a moved or deleted tile root before a 404
- pushes retry with backoff and can be re-queued by hand; the schedule lives in
  the database so a restart does not lose it
- access log plus /metrics counters

Image slicing
- tile_jobs drive the GDAL bundled with QGIS via scripts/gdal2tiles-qgis.bat
- layer_sources remembers what a layer is made of: submit one source to append
  a flight, or all of them to rebuild the layer as a VRT mosaic with no tile
  seams; the console exposes both, including a one-click rebuild
- slicing is available to integrations through a narrow slice token scope
  (submit, poll, idempotent by code, completion callback)

Console
- rebuilt around a fixed rail and single-view navigation with health and
  outstanding work leading, instead of one long scrolling page

Windows service
- native install/start/stop/status with crash recovery, auto-start and a
  rotating log file, so no NSSM wrapper is needed
- start-all.bat and stop-all.bat are removed: they killed the process by port
  with taskkill, which fought the service restart policy

Verified with 49 tests and live runs against real tile data and real GDAL.

demo/README.md

@@ -0,0 +1,62 @@
+# Demo Scripts
+
+This folder contains runnable demos for the internal remote-sensing result service.
+
+## Prerequisites
+
+- PostgreSQL and PostGIS are available to the API through `config/service.env`.
+- The Python environment is available at `PYTHON_EXE`.
+- Go is installed and can run `go run`.
+
+## Service Startup
+
+You can start the stack manually from the repository root:
+
+```powershell
+.\start-all.bat
+```
+
+Or use the self-contained full-flow demo to start a temporary stack on demo ports:
+
+```powershell
+.\demo\demo_full_flow.ps1 -StartStack -StartCallbackReceiver
+```
+
+## Demo List
+
+- `demo_import_and_slice.ps1`
+  Imports a raster result, binds a style, and triggers COG, preview, legend, and tile generation.
+- `demo_register_target_system.ps1`
+  Creates or updates a callback-based target system.
+- `demo_push_result.ps1`
+  Pushes an existing managed result to a target system or callback URL.
+- `demo_geojson_flow.ps1`
+  Registers a GeoJSON resource and optionally pushes it through the same delivery interface.
+- `demo_full_flow.ps1`
+  Runs the main end-to-end flow: sample raster, import, slice, target registration, and callback push.
+- `demo_callback_receiver.py`
+  Small local receiver for inspecting push payloads.
+
+## Suggested Order
+
+1. Start the services manually, or run `demo_full_flow.ps1 -StartStack -StartCallbackReceiver`.
+2. Run `demo_import_and_slice.ps1` to create a managed result.
+3. Run `demo_register_target_system.ps1` to register a callback receiver.
+4. Run `demo_push_result.ps1` to publish the managed result.
+5. Run `demo_geojson_flow.ps1 -Push` if you want to verify the retained GeoJSON delivery path.
+
+## Example Commands
+
+```powershell
+.\demo\demo_import_and_slice.ps1
+.\demo\demo_register_target_system.ps1 -CallbackUrl http://127.0.0.1:8920/callback
+.\demo\demo_push_result.ps1 -ResultCode demo_result_20260406_120000 -TargetSystemCode demo_callback
+.\demo\demo_geojson_flow.ps1 -Push -CallbackUrl http://127.0.0.1:8920/callback
+.\demo\demo_full_flow.ps1 -StartStack -StartCallbackReceiver
+```
+
+## Output
+
+Each demo prints a JSON summary that includes the main identifiers and URLs. Temporary run data is written under `temp/demo-runs/`.
+
+`source_system_code` is intentionally left empty in the demos. If you want to populate it, seed the `source_systems` table first.