Add navi-geo service (extraction #6) (#6)

* Add navi-geo service (extraction #6)

Faithful port of recon's geocode/reverse family to a new :8426 service:
  GET /api/geocode?q=&limit=&lat=&lon=&zoom=   Photon-first ranked search
  GET /api/reverse?lat=&lon=                   reverse geocode (Photon)
  GET /api/reverse/<lat>/<lon>                 reverse enrichment bundle (Central)

Ported modules: geocode.py (engine), netsyms.py (address SQLite), dem.py
(planet-DEM reader), address_book.py (reader copy), and the three handlers +
four bundle helpers from netsyms_api.py. All three routes public, behaviour-
identical to recon.

Behaviour-changing edges (both pre-decided in Phase A/B, called out in the PR):
- landclass: in-process call replaced with HTTP GET to navi-landclass :8424,
  reading .summary (the same most-specific unit-name string). First navi→navi
  edge after landclass itself.
- hardcoded paths/URLs → env vars (PHOTON_URL, NAVI_NETSYMS_DB,
  NAVI_TIMEZONE_DB, NAVI_DEM_PMTILES, NAVI_ADDRESS_BOOK_YAML,
  NAVI_LANDCLASS_URL); rerank trace log opt-in (NAVI_GEO_RERANK_TRACE_LOG,
  default off — recon always wrote /tmp).

No secrets in this service: PADUS_DB_* disappears because landclass is HTTP-
delegated (Phase A §10). Address book uses Option B (shared-file read), the
same pattern navi-contacts already uses.

Bundle 9-key contract preserved exactly (name/city/county/state/country/
postal_code/timezone/landclass/elevation_m), same null-on-component-failure
semantics, same in-memory TTLCache(10_000, 86_400) per worker.

Tests: 28 passing, 1 skipped (real timezone DB, off-box). Ported the 9 recon
reverse-bundle tests + added the HTTP-landclass coupling tests + hermetic
geocode reranker/intent-classifier tests (recon's geocode_test.py was a live
smoke test). Adds usaddress/rapidfuzz/cachetools/shapely/numpy/Pillow/pmtiles
to deps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* PR #6 review fixes

1. Rename geocode._setup_trace_logger → setup_trace_logger (public hook)
2. Hoist `import requests as http_requests` to module level in geo_route.py
3. Wire netsyms.health() into admin.py (enriches the netsyms filesystem entry
   with row_count/file_size_bytes/indexed_countries; no shared-builder change)
4. Fix misleading LANDCLASS_TIMEOUT_S comment (recon had no timeout)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: zvx-echo6 <mj@k7zvx.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/deploy/env/navi-geo.env.example

@@ -0,0 +1,29 @@
+# navi-geo — /etc/navi-backend/navi-geo.env
+# Geocode + reverse + reverse-bundle API (extraction #6). NO SECRETS in this
+# service: landclass is HTTP-delegated to navi-landclass, so PADUS_DB_* — the
+# only secret in recon's geocode/reverse path — disappears entirely (Phase A §10).
+
+# Photon geocoder (local). Single source of truth for the default lives in
+# services/navi_geo/geocode.py (DEFAULT_PHOTON_URL).
+PHOTON_URL=http://localhost:2322
+
+# navi-landclass HTTP coupling (the reverse bundle's `landclass` field).
+NAVI_LANDCLASS_URL=http://127.0.0.1:8424
+
+# Big external read-only data files (all stay external per the data-ownership
+# rule — Phase A §11: ~35 GB / ~123 MB / ~657 GB respectively).
+NAVI_NETSYMS_DB=/mnt/nav/addresses/AddressDatabase2025.sqlite
+NAVI_TIMEZONE_DB=/mnt/nav/sources/timezones.sqlite
+NAVI_DEM_PMTILES=/mnt/nas/nav/planet-dem.pmtiles
+
+# Address book (Phase B Option B: shared-file read; same file/var navi-contacts
+# uses — navi-contacts owns writes/UI, navi-geo only reads).
+NAVI_ADDRESS_BOOK_YAML=/home/zvx/projects/repos/navi-backend/config/address_book.yaml
+
+# OPTIONAL: rerank audit trace (DEBUG). UNSET = no FileHandler, no file written
+# (Phase B locked decision #3). Set to a writable path to enable, recon-style.
+# NAVI_GEO_RERANK_TRACE_LOG=/var/log/navi-backend/navi-geo-rerank.log
+
+# NOTE: recon's deployment_config (RECON_PROFILE / profiles dir) is intentionally
+# NOT wired here. Phase A §6 confirmed the geocode/reverse/bundle paths read NO
+# profile feature flags, so navi-geo carries no profile config (unlike navi-places).

backend/deploy/nginx/navi-geo.conf.snippet

@@ -0,0 +1,41 @@
+# =============================================================================
+# navi-geo — nginx integration for the navi.echo6.co vhost
+#
+# TWO blocks. Add INSIDE the existing
+#     server { server_name navi.echo6.co; ... }
+# block, BEFORE the existing `location /api/ { ... }` block.
+#
+# `^~` (lesson from extraction #1) makes nginx skip regex evaluation so the
+# asset-regex can't shadow these. The no-trailing-slash prefixes are deliberate:
+#
+#   ^~ /api/geocode   → /api/geocode?...
+#   ^~ /api/reverse   → BOTH /api/reverse?lat=&lon=  AND  /api/reverse/<lat>/<lon>
+#
+# The single `^~ /api/reverse` prefix catching both reverse forms is the whole
+# point — the query-string reverse (navi frontend) and the path-param reverse
+# bundle (Central) are different routes on the same service.
+#
+# Both endpoints are PUBLIC (no forward_auth) — TIER 2 @public_api in Caddy,
+# already routed through nginx :8440 since extraction #2. So NO Caddy edit.
+#
+# No proxy_cache: geocode/reverse vary per query and the reverse bundle has its
+# own in-memory TTLCache. `X-Cache-Status: BYPASS` for parity with the other
+# navi-* blocks.
+# -----------------------------------------------------------------------------
+    location ^~ /api/geocode {
+        proxy_pass http://127.0.0.1:8426;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Authentik-Username $http_x_authentik_username;
+        proxy_read_timeout 15s;
+        add_header X-Cache-Status BYPASS;
+    }
+
+    location ^~ /api/reverse {
+        proxy_pass http://127.0.0.1:8426;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Authentik-Username $http_x_authentik_username;
+        proxy_read_timeout 15s;
+        add_header X-Cache-Status BYPASS;
+    }

backend/deploy/systemd/navi-geo.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=navi-geo — geocode + reverse + reverse-bundle API (Echo6 navi-backend, extraction #6)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=zvx
+WorkingDirectory=/home/zvx/projects/repos/navi-backend
+EnvironmentFile=/etc/navi-backend/navi-geo.env
+ExecStart=/home/zvx/projects/repos/navi-backend/.venv/bin/gunicorn 'services.navi_geo.app:create_app()' --bind 127.0.0.1:8426 --workers 2
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=multi-user.target