feat(06-04): /api/route engine-A arm + http-source backend #2 — Bearer-gated, honest-null, RP re-pinned (GREEN)

- bot/src/routing/worker-router.ts: module-scope per-env graph memo (1 R2 GET per
  cold isolate, shared with the 06-07 cron arm via loadGraph), snap+A*+deriveSteps,
  claim-gated 401 / 4096-cap 413 / V5 bbox 400, 200-null on every miss class,
  ONE best route (no alternatives), category-only logs
- webhook.ts: /api/route arm delegating to handleRoute (405 non-POST)
- config.ts: ROAD_GRAPH: R2Bucket — first R2 binding (never a KV namespace, GE5)
- wrangler.jsonc: r2_buckets ROAD_GRAPH -> araharah-graphs with the fork law comment
- routing/src/http-source.ts: createHttpRoutingSource — slug-guard-first, fail-honest
  (throw/non-200/malformed/null-body -> null), defensive RouteResult validation;
  exported from index.ts; ladder note: backend #2 LIVE
- A7 re-pinned (06-01 named 06-04 as the owner of createHttpRoutingSource)
- test-side fix during GREEN: the R2 fake hands decodeGraph an exact ArrayBuffer
  (Node Buffers are views; encodeGraph output is already an ArrayBuffer)
- bot 103 passed / routing 65 passed; both typechecks clean

bot/src/webhook.ts

@@ -39,6 +39,11 @@
  *     structurally ignored (T-06-02); GET/DELETE resolve the record and
  *     compare envelope.chat_id === claim.chat_id, so foreign and absent
  *     are indistinguishable 404s (T-06-02b). DELETE is D-14's server half.
+ *   POST /api/route        → engine A's arm (06-04, D-01): Bearer-claim
+ *     gated EXACTLY like /api/location (T-06-01); the handler lives in
+ *     ./routing/worker-router.ts — the R2-hosted road graph, snap, A*, and
+ *     the honest-null degradation (D-03) all live there. Every miss class
+ *     answers 200 null; rejections are category-only (T-06-04).
  * Anything else → 404.
  *
  * D-14: the ONLY log statements are category-only — malformed/tampered/stale
@@ -60,6 +65,7 @@ import {
   deleteGuidanceSession,
   type GuidanceRouteSnapshot,
 } from "./kv/guidance-sessions.ts";
+import { handleRoute } from "./routing/worker-router.ts";
 import { decodePolyline6 } from "@araharah/routing/src/polyline.ts";
 import { validateInitData } from "./security/initdata.ts";
 import { pickLocale } from "./i18n/strings.ts";
@@ -95,6 +101,9 @@ export default {
     if (url.pathname === "/api/guidance") {
       return handleGuidance(req, env);
     }
+    if (url.pathname === "/api/route") {
+      return handleRoute(req, env);
+    }
     return new Response("Not found", { status: 404 });
   },
 } satisfies ExportedHandler<Env>;