feat(06-04): /api/route engine-A arm + http-source backend #2 — Bearer-gated, honest-null, RP re-pinned (GREEN)

- bot/src/routing/worker-router.ts: module-scope per-env graph memo (1 R2 GET per
  cold isolate, shared with the 06-07 cron arm via loadGraph), snap+A*+deriveSteps,
  claim-gated 401 / 4096-cap 413 / V5 bbox 400, 200-null on every miss class,
  ONE best route (no alternatives), category-only logs
- webhook.ts: /api/route arm delegating to handleRoute (405 non-POST)
- config.ts: ROAD_GRAPH: R2Bucket — first R2 binding (never a KV namespace, GE5)
- wrangler.jsonc: r2_buckets ROAD_GRAPH -> araharah-graphs with the fork law comment
- routing/src/http-source.ts: createHttpRoutingSource — slug-guard-first, fail-honest
  (throw/non-200/malformed/null-body -> null), defensive RouteResult validation;
  exported from index.ts; ladder note: backend #2 LIVE
- A7 re-pinned (06-01 named 06-04 as the owner of createHttpRoutingSource)
- test-side fix during GREEN: the R2 fake hands decodeGraph an exact ArrayBuffer
  (Node Buffers are views; encodeGraph output is already an ArrayBuffer)
- bot 103 passed / routing 65 passed; both typechecks clean

routing/src/index.ts

@@ -13,18 +13,18 @@
  * THE BACKEND LADDER (D-01 supersedes the phase-5 "wasm-router" note):
  *   #1  "fixture"   — createFixtureRoutingSource: the golden-pairs demo
  *                     corpus (15 committed KL pairs).
- *   #2  "engine-a"  — the Worker-side router built on THIS plan's data
- *                     plane: decodeGraph + snapToGraph + routeAstar over an
- *                     R2-hosted CSR graph binary. Engine B (a fully
+ *   #2  "engine-a"  — LIVE (plan 06-04): the Worker-side router built on
+ *                     THIS package's data plane (decodeGraph + snapToGraph +
+ *                     routeAstar over an R2-hosted CSR graph), consumed
+ *                     client-side through createHttpRoutingSource (the
+ *                     Bearer-gated POST /api/route seam). Engine B (a fully
  *                     client-side webview router — graph on the phone) is
  *                     engine A's documented post-v1 evolution (D-02). The
  *                     Valhalla-to-JS port was ruled infeasible and
  *                     geojson-path-finder rejected (demo-grade: no
  *                     alternatives/one-ways) — recorded so neither is ever
  *                     re-proposed (D-02).
- *   Plan 04 adds `createHttpRoutingSource` (the /api/route surface that
- *   plugs engine A beneath the RoutingSource seam) — deliberately absent
- *   here.
+ *   Engine B remains the documented future rung; nothing else is planned.
  *
  * The module reads NO environment, NO secrets, and NO network (D-05/D-12):
  * the whole routing stack is V8-native and dependency-free — fixtures ride
@@ -44,6 +44,8 @@ export {
   getPairOrigin,
   getPairs,
 } from "./fixture-source.ts";
+export { createHttpRoutingSource } from "./http-source.ts";
+export type { HttpRoutingSourceOptions } from "./http-source.ts";
 export type { RoadGraph, GraphEdgeInput, GraphInput } from "./graph.ts";
 export {
   decodeGraph,