feat: add pinned inventory location enrichment

docs/esi-operations.md

@@ -4,8 +4,9 @@ The server ESI adapter uses the fixed trusted base `https://esi.evetech.net` and
 `X-Compatibility-Date: 2026-08-18` (`ESI_COMPATIBILITY_DATE`). It exposes a fixed
 allowlist of typed safe reads: character assets (paged GET), character asset names
 and locations (bounded read-only POST), character wallet balance (unpaged GET), and
-global market prices (unpaged GET). Callers cannot provide an arbitrary ESI
-URL, host, method, or POST body.
+global market prices (unpaged GET), and character-scoped private structure
+resolution (fixed GET). Callers cannot provide an arbitrary ESI URL, host, method,
+or POST body.
 
 ## Asset synchronization
 
@@ -84,6 +85,19 @@ JavaScript literals. Asset helper metadata cites pinned OpenAPI evidence; wallet
 metadata cites the current official OpenAPI retrieval and explicitly records that
 it is not an immutable historical capture.
 
+## Private structure resolution
+
+`EsiClient.getStructure` calls the pinned `GET /universe/structures/{structure_id}`
+operation with `esi-universe.read_structures.v1`. The route and scope are pinned in
+`docs/research/eve.md` and the captured OpenAPI evidence: a 200 is character-scoped
+ESI access evidence, while 403 and 404 remain explicit unresolved outcomes. IDs are
+validated and serialized as decimal text without `Number` coercion. The response
+retains the optional name, solar-system, owner/type IDs and finite position with
+retrieval/expiry provenance. The T08 cache includes the complete authority and
+reference version; it never stores tokens and never derives ACL membership or
+docking permission (`unknown` is the only permission value). Deadlines, rate limits,
+and transport failures remain typed errors for T07 retry/cooldown handling.
+
 ## Wallet balance
 
 `EsiClient.getWalletBalance` reads the unpaged character wallet route with the