feat(spp_api_v2_gis): OGC processes/jobs + incidents API (re-land from #76)

[gonzalesedwin1123]

Re-lands the spp_api_v2_gis portion of reverted PR #76 (revert: #271). Wave 4 — DRAFT until ALL of these merge: #273 (spp_gis), #274 (spp_hazard), #276 (spp_api_v2), #279, #280. Base is set to reland/gis-report to keep the diff scoped, but the branch also requires #273/#274/#276 in 19.0 — CI can only be fully green after they land; I'll mark this ready then.

Summary

• OGC API Processes/Jobs framework: async process execution, job model, cleanup cron, process registry.
• Incidents collection with CAP severity/event filters (uses the feat(spp_hazard): CAP vocabulary severity and alert ingestion, with upgrade migration (re-land from #76) #274 hazard fields).
• Router consolidation: replaces the geofence/proximity/spatial_query routers; geofence CRUD via OGC Features.
• Polymorphic OpenAPI schemas via spp_api_v2 utils (feat(spp_api_v2): OpenAPI polymorphic bodies, OAuth2 scheme in auth middleware, bundle schemas (re-land from #76) #276).

Verification

• ./spp t spp_api_v2_gis on an integration state with all five prerequisites merged at their CURRENT tips (including feat(spp_api_v2): OpenAPI polymorphic bodies, OAuth2 scheme in auth middleware, bundle schemas (re-land from #76) #276's reworked OpenAPI generator): 363 passed, 0 failed
• Deep audit: byte-identical restore of the pre-revert state; all four legacy router/schema deletions verified; no post-feat: geofence-based geographic targeting for programs #76 mainline overlap; full lint gauntlet (ruff/pylint-odoo/semgrep/bandit/prettier) passed locally; README regenerated with the HISTORY section

[gemini-code-assist]

Warning

Gemini encountered an error creating the review. You can try again by commenting /gemini review.

[gonzalesedwin1123]

Promotion checklist addition — external consumer coupling (found while assessing the #274 hold):

This PR's router consolidation deletes /gis/geofences (CRUD), /gis/query/proximity, and /gis/query/spatial — endpoints that PRISM actively calls (prism-app/frontend/src/utils/openspp-api.ts:166-217: proximity query + full geofence CRUD). PRISM already uses /gis/ogc/collections in places, so the migration to the consolidated OGC surface appears started but unfinished.

Before this PR merges (in addition to waiting on #274 for the incidents feature):

1. A paired prism-app change migrating openspp-api.ts geofence/proximity utilities to the OGC endpoints, landing in lockstep.
2. Confirm QGIS flows are unaffected (QML export + OGC features are retained; OAuth discovery already merged via feat(spp_api_v2): OpenAPI polymorphic bodies, OAuth2 scheme in auth middleware, bundle schemas (re-land from #76) #276).

Postponing this PR keeps PRISM working as-is — the coupling only bites at merge time.