Basemap Pusher: catalog and distribution gateway for existing tiles

A Go service that scans existing basemap tile directories and vector files,
catalogues them in SQLite, issues scoped access tokens, and serves tiles and
downloads to downstream systems. It deliberately does not generate or process
raster data: GIS software produces the tiles, this service catalogues,
authorises and distributes them.

Capabilities
- scans basemap tile directories (manifest-based or raw z/x/y) and vector
  assets (.geojson, .json, .zip, shapefiles with sidecars)
- token auth with per-resource grants, expiry and coarse scopes (read, slice)
- resource health inspection flags a moved or deleted tile root before a client
  hits a 404
- downstream push with exponential-backoff retries and manual re-queue
- image slicing jobs driven by the GDAL bundled with QGIS, including VRT
  mosaicking so successive drone flights accumulate into one seamless layer
- a narrow, non-admin slicing API for external callers: submit, poll,
  idempotent by job code, completion callback
- ops console covering health, ledger, tokens, pushes, scans, slicing and
  service info
- native Windows service install/start/stop with crash recovery, auto-start and
  a rotating log file, so no NSSM or WinSW wrapper is needed

Verified with 49 tests plus live runs against real tile data and real GDAL.

scripts/build-api.bat

@@ -0,0 +1,49 @@
+@echo off
+setlocal
+chcp 65001 >nul 2>&1
+title Build Basemap Pusher
+
+set "ROOT=%~dp0..\\"
+pushd "%ROOT%" >nul 2>&1
+set "ROOT=%CD%\"
+popd
+call "%ROOT%scripts\load-env.bat" "%ROOT%config\service.env"
+
+REM Keep the toolchain caches inside the repo, the same way run-api.bat does.
+REM Without this, go build uses the global module cache and reaches out to
+REM proxy.golang.org, which is blocked on many internal networks.
+if "%GOCACHE%"=="" set "GOCACHE=%ROOT%.gocache"
+if "%GOMODCACHE%"=="" set "GOMODCACHE=%ROOT%.gomodcache"
+if "%GOTMPDIR%"=="" set "GOTMPDIR=%ROOT%.gotmp"
+if "%GOPATH%"=="" set "GOPATH=%ROOT%.gopath"
+if "%GOPROXY%"=="" set "GOPROXY=https://goproxy.cn,direct"
+if "%GOSUMDB%"=="" set "GOSUMDB=off"
+
+set "OUT=%ROOT%bin\basemap-pusher.exe"
+if not exist "%ROOT%bin" mkdir "%ROOT%bin" >nul 2>&1
+
+echo ========================================
+echo   Building Basemap Pusher
+echo ========================================
+echo Output: %OUT%
+echo.
+
+pushd "%ROOT%services\api-go"
+go build -o "%OUT%" .\cmd\api
+set "BUILD_EXIT=%ERRORLEVEL%"
+popd
+
+if not "%BUILD_EXIT%"=="0" (
+  echo.
+  echo [FAIL] Build failed with exit code %BUILD_EXIT%.
+) else (
+  echo.
+  echo [OK] Built %OUT%
+  echo.
+  echo Install as a Windows service ^(elevated shell^):
+  echo   "%OUT%" --env-file "%ROOT%config\service.env" install
+  echo   "%OUT%" start
+)
+
+if "%NO_PAUSE%"=="" pause
+exit /b %BUILD_EXIT%