feat(06-04): /api/route engine-A arm + http-source backend #2 — Bearer-gated, honest-null, RP re-pinned (GREEN)

- bot/src/routing/worker-router.ts: module-scope per-env graph memo (1 R2 GET per
  cold isolate, shared with the 06-07 cron arm via loadGraph), snap+A*+deriveSteps,
  claim-gated 401 / 4096-cap 413 / V5 bbox 400, 200-null on every miss class,
  ONE best route (no alternatives), category-only logs
- webhook.ts: /api/route arm delegating to handleRoute (405 non-POST)
- config.ts: ROAD_GRAPH: R2Bucket — first R2 binding (never a KV namespace, GE5)
- wrangler.jsonc: r2_buckets ROAD_GRAPH -> araharah-graphs with the fork law comment
- routing/src/http-source.ts: createHttpRoutingSource — slug-guard-first, fail-honest
  (throw/non-200/malformed/null-body -> null), defensive RouteResult validation;
  exported from index.ts; ladder note: backend #2 LIVE
- A7 re-pinned (06-01 named 06-04 as the owner of createHttpRoutingSource)
- test-side fix during GREEN: the R2 fake hands decodeGraph an exact ArrayBuffer
  (Node Buffers are views; encodeGraph output is already an ArrayBuffer)
- bot 103 passed / routing 65 passed; both typechecks clean

bot/wrangler.jsonc

@@ -20,5 +20,13 @@
   // It must equal the Mini App URL registered in @BotFather (Bot API 10.2
   // enforces the origin). Never derived from user input.
   "vars": { "MINI_APP_URL": "https://araharah-bot.araharah-bot.workers.dev" },
+  // R2 binding (D-01, the repo's FIRST r2_buckets entry): hosts the road-graph
+  // binary /api/route loads (worker-router.ts memoizes ONE GET per cold
+  // isolate). A bucket is NOT a KV namespace — GE5 (exactly ONE
+  // kv_namespaces) still holds. Forks create + upload their OWN bucket:
+  // `npx wrangler r2 bucket create <name>` + routing/scripts/upload-road-graph.mjs
+  // (docs/ROAD-GRAPH.md is the fork contract). The bucket name is public
+  // configuration, never a secret.
+  "r2_buckets": [{ "binding": "ROAD_GRAPH", "bucket_name": "araharah-graphs" }],
   "kv_namespaces": [{ "binding": "chat_sessions", "id": "59f58a54bc44483e89872b20a005a5eb" }]
 }