feat: add governed nationwide AOI orchestration and CUDA enforcement

docs/DATABASE_IMPLEMENTATION_PLAN.md

@@ -318,6 +318,22 @@ Official editions take precedence over legacy rolling markers in catalog
 comparison, but direct metadata backfill, update or deletion of those legacy
 rows remains prohibited.
 
+## Resumable AOI operations
+
+Migration `202607260001` adds `aoi_operations` and
+`aoi_operation_partitions`. The parent stores the immutable EPSG:4326 AOI
+snapshot, original request and source-specific plan. Child rows store exact
+partition geometry, stable `(operation_id, partition_key)` identity, provider
+and product, attempt budget, checkpoint, result and child Job linkage.
+
+Workers atomically claim queued child rows. Interrupted running rows return to
+queued state while attempts remain and become failed when exhausted. Provider
+output still flows through the existing DatasetService/provider contracts;
+these tables orchestrate work and never become a parallel dataset store.
+The all-in-one runtime enables one database-polling worker. Multiple future
+workers remain safe because partition claim uses `FOR UPDATE SKIP LOCKED` and
+the partition key is unique inside its parent operation.
+
 ## Geometry normalization
 
 - User-drawn polygons arrive as EPSG:4326.