Add Flemish bathymetry partition workflow

docs/API_CONTRACTS.md

@@ -2061,10 +2061,20 @@ sets an explicit Ollama context window and returns
 ### GET `/api/v1/projects/{project_id}/datasets/bathymetry/sources`
 
 Returns the governed bathymetry source registry in the canonical envelope.
-VHA inland profiles are `operational`. MDK Belgian Continental Shelf and SPW
-Walloon bathymetry remain `available_not_integrated`; they cannot be acquired
-through this contract until their raster/download and vertical-datum flows
-pass live validation.
+VHA inland profiles are `operational`. MDK Belgian Continental Shelf is
+`probe_only`; SPW Walloon bathymetry remains `available_not_integrated`.
+Neither source can be acquired until its raster/download and vertical-datum
+flow passes live validation.
+
+### GET `/api/v1/projects/{project_id}/datasets/bathymetry/sources/mdk_bcp_bathymetry/readiness`
+
+Runs one bounded, read-only WCS 1.0.0 `GetCapabilities` request with mandatory
+system TLS verification and a configured response-size limit. Status is one
+of `disabled`, `invalid_configuration`, `tls_error`,
+`endpoint_unavailable`, `invalid_capabilities` or `reachable`. A reachable
+response lists coverage identifiers, advertised formats and CRS values, but
+always returns `acquisition_supported=false`. There is no insecure TLS
+fallback and no `GetCoverage` request.
 
 ### POST `/api/v1/projects/{project_id}/datasets/bathymetry/profiles/acquire`
 
@@ -2089,3 +2099,18 @@ The acquired Dataset uses
 `reference_layer_name=bathymetry_profiles`. Existing vector content and
 selection endpoints provide GeoJSON and metrics. The contract does not expose
 a continuous bathymetric surface, current water depth or water volume.
+
+### POST `/api/v1/projects/{project_id}/datasets/bathymetry/profiles/partitions/finalize`
+
+Finalizes a complete municipality-partition manifest. The request supplies a
+scope key, every expected municipality Area id, one ready VHA Dataset id for
+each non-empty partition, explicit Area ids with zero source profiles, a
+SHA-256 manifest identity and observation time. The backend verifies project,
+Area, provider, Dataset and one-Dataset-per-Area consistency. Only a complete
+accounting sets `partitioned_source_audit=true` and
+`regional_partitions_complete=true`; partial operator runs remain hidden at
+regional scope.
+
+Future provider output continues to use DatasetService and, for vectors,
+VectorFeatureService. Arbitrary service URLs, browser-side fetches, insecure
+TLS bypasses and startup downloads remain forbidden.