feat(map): add cache-first Cesium gateway and AMD egress

services/dc-amd-connector/README.md

@@ -0,0 +1,84 @@
+# DC AMD Connector
+
+DC AMD Connector runs on the adjacent AMD Windows machine. It is a restricted
+HTTP `CONNECT` proxy for the NODE.DC map path:
+
+```text
+NAS DC AMD Proxy -> 172.22.0.183:8791 -> AMD VPN -> Cesium / Bing
+```
+
+It is not a general-purpose proxy:
+
+- only authenticated `CONNECT` requests are accepted;
+- only port `443` is accepted;
+- only Cesium Ion and required Bing imagery hosts are accepted;
+- ordinary HTTP proxy requests are rejected;
+- the Ion bearer token stays inside the end-to-end TLS connection from NAS to
+  Cesium and is not processed or logged by this connector.
+
+The Windows host owns the VPN. The NAS uses only the stable LAN address in
+`.env`, never an OpenVPN adapter address or a changing public VPN exit IP.
+
+## First run on the AMD machine
+
+1. Start Docker Desktop and wait for its engine to be running.
+2. Open **PowerShell as Administrator** and run `install.ps1` from this
+   package folder. It verifies source checksums, copies the package to
+   `C:\\NODEDC\\dc-amd-connector`, creates a local random access token without
+   printing it, binds port `8791` only to `172.22.0.183`, scopes Windows
+   Firewall to NAS `172.22.0.222`, constrains the container to one CPU, 256 MB,
+   64 processes and 4096 file descriptors, and starts the container. It also
+   adds a launcher to the current user's Windows Startup folder. At the next
+   user sign-in it uses the Docker Desktop CLI when available, otherwise its
+   installed application; the `unless-stopped` restart policy then restores
+   this container.
+
+   ```powershell
+   powershell -NoProfile -ExecutionPolicy Bypass -File .\\install.ps1
+   ```
+
+3. Do not send the runtime secret in chat or put it into a source file. The
+   next NAS patch will provision the same value in a root-owned secret file
+   through an operator-only transfer.
+
+Docker Desktop on the WSL 2 backend is a desktop application, not an
+unattended Windows boot daemon. Thus this recovery guarantee starts after the
+configured Windows user signs in. Before a sign-in, the map must use its
+offline/tile-cache path. No Windows route, VPN, DNS, proxy setting or other
+application's traffic is modified.
+
+## Operations and migration
+
+Run these commands from an elevated PowerShell window:
+
+```powershell
+cd C:\\NODEDC\\dc-amd-connector
+docker compose ps
+docker compose logs --tail 100
+docker compose restart
+```
+
+`docker compose down` is an intentional stop and removes the container; restore
+it with `docker compose up -d`. The auto-start launcher is removed by
+`uninstall.ps1`.
+
+To move to a different adjacent Windows host: install this same package there
+with its stable LAN address (`-BindAddress`) and verify its VPN tunnel first.
+It creates a fresh local access secret. Only then may the separate NAS pairing
+patch be changed to the new host; never run two active pairings against the
+same NAS endpoint.
+
+## Verification
+
+The connector health check uses the local runtime secret inside the container.
+It is expected to become `healthy` without making any external request. The
+following local check proves a permitted TLS tunnel through the current AMD VPN
+without revealing the access token:
+
+```powershell
+docker exec dc-amd-connector node -e "const fs=require('fs'),net=require('net');const t=fs.readFileSync('/run/dc-amd-secrets/connector-access','utf8').trim();const s=net.connect(8791,'127.0.0.1',()=>s.write('CONNECT api.cesium.com:443 HTTP/1.1\r\nHost: api.cesium.com:443\r\nProxy-Authorization: Bearer '+t+'\r\n\r\n'));s.once('data',d=>{const v=d.toString('ascii');console.log(v.split('\r\n')[0]);s.destroy();process.exit(v.startsWith('HTTP/1.1 200')?0:1)});s.on('error',e=>{console.error(e.message);process.exit(1)})"
+```
+
+Expected output is `HTTP/1.1 200 Connection Established`. If the AMD VPN is
+off, this test must fail; it must never silently move live Cesium traffic to
+the NAS.