feat(06-04): /api/route engine-A arm + http-source backend #2 — Bearer-gated, honest-null, RP re-pinned (GREEN)

- bot/src/routing/worker-router.ts: module-scope per-env graph memo (1 R2 GET per
  cold isolate, shared with the 06-07 cron arm via loadGraph), snap+A*+deriveSteps,
  claim-gated 401 / 4096-cap 413 / V5 bbox 400, 200-null on every miss class,
  ONE best route (no alternatives), category-only logs
- webhook.ts: /api/route arm delegating to handleRoute (405 non-POST)
- config.ts: ROAD_GRAPH: R2Bucket — first R2 binding (never a KV namespace, GE5)
- wrangler.jsonc: r2_buckets ROAD_GRAPH -> araharah-graphs with the fork law comment
- routing/src/http-source.ts: createHttpRoutingSource — slug-guard-first, fail-honest
  (throw/non-200/malformed/null-body -> null), defensive RouteResult validation;
  exported from index.ts; ladder note: backend #2 LIVE
- A7 re-pinned (06-01 named 06-04 as the owner of createHttpRoutingSource)
- test-side fix during GREEN: the R2 fake hands decodeGraph an exact ArrayBuffer
  (Node Buffers are views; encodeGraph output is already an ArrayBuffer)
- bot 103 passed / routing 65 passed; both typechecks clean

bot/test/webhook.test.mjs

@@ -522,10 +522,18 @@ const CORRIDOR_BUF = corridorGraphBuffer();
 const SPLIT_BUF = corridorGraphBuffer({ gap: true });
 const SPARSE_BUF = sparseGraphBuffer();
 
-/** An R2 fake over one fixed binary; counts + records its gets (the memo probe). */
+/** An R2 fake over one fixed binary; counts + records its gets (the memo probe).
+ *  Node Buffers are views over a pooled ArrayBuffer — the fake hands over an
+ *  exact copy (the astar suite's toArrayBuffer law) so decodeGraph sees what
+ *  a real R2 arrayBuffer() returns. */
 function r2With(maybeBuf) {
   let gets = 0;
   let lastKey = null;
+  const exact = () => {
+    if (maybeBuf === null) return null;
+    if (maybeBuf instanceof ArrayBuffer) return maybeBuf; // encodeGraph's product
+    return maybeBuf.buffer.slice(maybeBuf.byteOffset, maybeBuf.byteOffset + maybeBuf.byteLength); // fs Buffer (view)
+  };
   return {
     gets: () => gets,
     lastKey: () => lastKey,
@@ -533,7 +541,7 @@ function r2With(maybeBuf) {
       gets += 1;
       lastKey = key;
       if (maybeBuf === null) return null; // R2 object absent
-      return { arrayBuffer: async () => maybeBuf };
+      return { arrayBuffer: async () => exact() };
     },
   };
 }