Shell ref-rendering for peer-owned storage: tiles, signed-URL documents, zero peer-data persistence

[mortonanalytics]

TerraYield need (storage stays in the app). The no-centralization invariant says apps own tile servers, raster stores (COGs in S3/MinIO via titiler), and report generators; IONe renders refs. TerraYield's refs are concretely: titiler tile URLs (MapLibre-consumable), expiring signed URLs for PDFs/CSV/GeoJSON exports, and MCP resources for tabular data. None of this rendering exists against a real peer.

Acceptance

• Shell renders a peer map layer from a peer-hosted tile URL template (no tile proxying/re-hosting in IONe).
• MIME-typed document refs (application/pdf, text/csv, application/geo+json) render/download via the peer's signed URL; expired-URL handling is defined (re-request the ref, not cache the object).
• Stated + tested guarantee: IONe persists no peer payload data beyond a bounded render cache (TTL); peer data never lands in IONe's Postgres/MinIO.
• Table/chart rendering from MCP resources honors the contract's pagination for large payloads.

Depends on the peer-client and contract-v1 issues. Verifiable against the stub peer.

[mortonanalytics]

Landed in #23, merged as d38683a. (The PR body's Closes #12, #13, … list only auto-linked #12 — closing the rest manually.)