feat(03-01): GEO-02 server half both directions — chat-keyboard fallback + GET /api/location + POST /api/location-fallback (claim-scoped)

- handlers/location-fallback.ts: requestLocationFallback (ReplyKeyboardMarkup request_location:true copy from strings.ts), recordSharedPin, registerLocationFallback (filters message.location, T-03-03)
- strings.ts: awaitingPin/shareLocationButton/pinReceived in en+ms (CS1 parity) — all bot copy stays in strings.ts
- bot.ts: createBot threads env.chat_sessions into the fallback handler; optional client fetch seam for tests; one-caller rule documented
- webhook.ts: GET /api/location relay + POST /api/location-fallback trigger, both resolve chat_id & locale from getClaimByToken CLAIM, never client input (T-03-01/26/27); telegram-send failure is category-only 502 (T-03-28)
- location-pin.test.mjs: LP1–LP14 (TTL contract, range guard, cross-user isolation both routes, locale split); LP12/LP13 patch node-fetch's cached default (grammy's node shim transport), then restore
- CS4 scope untouched (handlers/ not scanned); CS1 parity automatic

bot/src/webhook.ts

@@ -21,6 +21,18 @@
  *     own invariant (D-07 — best-effort under KV eventual consistency, see
  *     sessions.ts) — this endpoint adds no extra branch and no extra write
  *     path (T-02-06).
+ *   GET  /api/location      → GEO-02 relay (T-03-01): the Mini App polls
+ *     here with its memory-held Bearer token; the token resolves through
+ *     getClaimByToken and the KV key loc:<chat_id> derives from the
+ *     CLAIM — never from a client-supplied id — so one user's token can
+ *     never read another user's pin. No pin or expired token → honest
+ *     nulls / 401, nothing fabricated.
+ *   POST /api/location-fallback → GEO-02 keyboard trigger (T-03-26): the
+ *     app's denied card asks the BOT to send the request_location reply
+ *     keyboard into the user's own chat. The target chat_id AND the
+ *     locale come from the resolved claim (T-03-27) — the request body
+ *     is never read, and no chat id or language is accepted from the
+ *     client. A rejected Telegram send is a category-only 502 (T-03-28).
  * Anything else → 404.
  *
  * D-14: the ONLY log statements are category-only — malformed/tampered/stale
@@ -33,8 +45,11 @@
 import { webhookCallback } from "grammy";
 import type { Env } from "./config.ts";
 import { createBot } from "./bot/bot.ts";
-import { mintSession } from "./kv/sessions.ts";
+import { requestLocationFallback } from "./bot/handlers/location-fallback.ts";
+import { mintSession, getClaimByToken } from "./kv/sessions.ts";
+import { getPin } from "./kv/location-pin.ts";
 import { validateInitData } from "./security/initdata.ts";
+import { pickLocale } from "./i18n/strings.ts";
 
 export default {
   async fetch(req: Request, env: Env, _ctx: ExecutionContext): Promise<Response> {
@@ -58,6 +73,12 @@ export default {
     if (url.pathname === "/api/session") {
       return handleSession(req, env);
     }
+    if (url.pathname === "/api/location") {
+      return handleLocation(req, env);
+    }
+    if (url.pathname === "/api/location-fallback") {
+      return handleLocationFallback(req, env);
+    }
     return new Response("Not found", { status: 404 });
   },
 } satisfies ExportedHandler<Env>;
@@ -112,3 +133,70 @@ async function handleSession(req: Request, env: Env): Promise<Response> {
   });
   return new Response(JSON.stringify({ token }), { status: 200, headers: { "content-type": "application/json" } });
 }
+
+/** GEO-02 relay (T-03-01): the Mini App polls here with its memory-held
+ *  Bearer token to pick up a pin the user shared in chat. V4 Access
+ *  Control (RESEARCH §Security Domain): the bearer token is resolved via
+ *  getClaimByToken; a missing/expired token is a 401. The KV key is
+ *  derived from the CLAIM's chat_id — NEVER from a client-supplied chat
+ *  id, so one user's token can never read another user's pin. */
+async function handleLocation(req: Request, env: Env): Promise<Response> {
+  if (req.method !== "GET") return new Response("Method not allowed", { status: 405 });
+  const header = req.headers.get("authorization") ?? "";
+  const match = header.match(/^Bearer ([A-Za-z0-9-]+)$/);
+  const token = match !== null && match[1] ? match[1] : null;
+  const claim = token === null ? null : await getClaimByToken(env.chat_sessions, token);
+  if (claim === null) {
+    console.log("[location] rejected: unauthorized"); // category ONLY (D-14)
+    return new Response(JSON.stringify({ error: "unauthorized" }), {
+      status: 401,
+      headers: { "content-type": "application/json" },
+    });
+  }
+  const pin = await getPin(env.chat_sessions, claim.chat_id);
+  return new Response(JSON.stringify({ pin }), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+/** GEO-02 trigger (T-03-26): the Mini App's denied card taps ASK VIA CHAT
+ *  and POSTs here; the Worker asks the BOT to send the request_location
+ *  reply keyboard in the user's own chat. Same V4 access control as
+ *  handleLocation — the target chat_id comes from the resolved CLAIM,
+ *  never from the request body, so one user's token can never push a
+ *  keyboard into another user's chat.
+ *
+ *  The locale comes from `claim.language_code`, which mintSession already
+ *  recorded from the validated initData — the Worker does NOT re-derive it
+ *  from client input, and no language is accepted from the request body
+ *  (T-03-27). */
+async function handleLocationFallback(req: Request, env: Env): Promise<Response> {
+  if (req.method !== "POST") return new Response("Method not allowed", { status: 405 });
+  const header = req.headers.get("authorization") ?? "";
+  const match = header.match(/^Bearer ([A-Za-z0-9-]+)$/);
+  const token = match !== null && match[1] ? match[1] : null;
+  const claim = token === null ? null : await getClaimByToken(env.chat_sessions, token);
+  if (claim === null) {
+    console.log("[location-fallback] rejected: unauthorized"); // category ONLY (D-14)
+    return new Response(JSON.stringify({ error: "unauthorized" }), {
+      status: 401,
+      headers: { "content-type": "application/json" },
+    });
+  }
+  try {
+    await requestLocationFallback(createBot(env), claim.chat_id, pickLocale(claim.language_code));
+    return new Response(JSON.stringify({ ok: true }), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  } catch {
+    // Telegram rejected the send (user blocked the bot, chat not found, rate
+    // limit). Category only — never the chat id, never the error text (D-14, T-03-28).
+    console.log("[location-fallback] failed: telegram-send");
+    return new Response(JSON.stringify({ error: "unavailable" }), {
+      status: 502,
+      headers: { "content-type": "application/json" },
+    });
+  }
+}