fix(serve): expose cached on-demand chunks through tile GET

[adarshh347]

Coordinate GET currently returns 404 for existing on-demand chunks. Fall back to the configured OnDemandTiles.cached_chunk_path after a materialized-file miss, validate that the result is a file contained in the configured cache root, and never render on GET.

Preserve normal-file precedence and MIME behavior, document raw-chunk semantics, and correct the comment suggesting never-rendered, budget-skipped hits can necessarily be fetched through /tile. Unresolvable cache paths return 404.

Validation:

• The cached-PNG regression fails against the original handler (404 instead of 200); the symlink-loop regression also failed before its correction.
• uv run --no-sync pytest -q tests/test_serve_cached_tiles.py tests/test_serve_ondemand_budget.py tests/test_serve_backends.py tests/test_serve_image_input.py tests/test_serve_reconstruct.py tests/test_department_search.py: 50 passed, 0 skipped.
• uvx ruff check and uvx ruff format --check on both changed files, plus git diff --check: passed.
• Tests use FastAPI TestClient, tiny images, a fake that forbids rendering, and the real cache lookup with rendering forbidden. They cover precedence, MIME, invalid/missing coordinates, containment, no on-demand instance, and disappearing files.

Limitations: the full repository suite was not run. No models, Chrome rendering, paid APIs, or production services were used. Cold-cache misses remain 404; bounded rendering needs a separate design. GET serves raw cached chunks, including padding, whereas /search can trim using indexed tile_height; pixel parity remains a maintainer decision without adding an index scan. Deletion after the file check retains the existing FileResponse error contract.

Checked against current upstream and PRs #140 and #164: #164 is merged; #140 remains open and overlaps on containment, but this change does not expand the separate legacy-path security work.

[vercel]

@adarshh347 is attempting to deploy a commit to the andylizf's projects Team on Vercel.

A member of the Team first needs to authorize it.