fix(planner): keep journal callback token off the client (#2 Phase A)

The Save-to-Journal flow had the browser fetch the journal with a
\`Bearer \${callbackToken}\` header. The JWT was visible in DevTools,
exfiltratable via any XSS or browser extension, and the planner's
\`loader\` shipped it down to the client as part of the page payload.

Now:

- **New action**: \`POST /api/save-to-journal\` (\`routes/api.save-to-journal.ts\`).
  Body: \`{ sessionId, gpx }\`. The action loads \`callbackUrl\` +
  \`callbackToken\` from \`planner.sessions\` (set at /new time when the
  user came from the journal), POSTs to the journal server-to-server
  with the Bearer, and forwards the response.

- **\`SaveToJournalButton\`**: drops the \`callbackUrl\` + \`callbackToken\`
  props. Takes \`sessionId\` only and POSTs to the planner action.

- **\`session.\$id.tsx\` loader**: stops returning \`callbackUrl\` /
  \`callbackToken\` to the client. Returns a single \`hasJournalCallback\`
  boolean so the button still knows whether to render.

- **\`SessionView\`**: same prop simplification.

Trust model is unchanged: the same \`sessionId\` that grants Yjs
membership grants save authority. Knowing the URL = ability to act.
The action only adds a server-side hop so the JWT never reaches
browser JS.

Phase B (jti single-use enforcement on the journal side) follows in
a separate PR — needs a journal DB column + verifier change.

Full repo: pnpm typecheck / lint / test all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/planner/app/components/SaveToJournalButton.tsx

@@ -8,12 +8,11 @@ import { waypointFromYMap } from "~/lib/waypoint-ymap";
 
 interface SaveToJournalButtonProps {
   yjs: YjsState;
-  callbackUrl: string;
-  callbackToken: string;
+  sessionId: string;
   returnUrl?: string;
 }
 
-export function SaveToJournalButton({ yjs, callbackUrl, callbackToken, returnUrl }: SaveToJournalButtonProps) {
+export function SaveToJournalButton({ yjs, sessionId, returnUrl }: SaveToJournalButtonProps) {
   const { t } = useTranslation("planner");
   const [saving, setSaving] = useState(false);
   const [saved, setSaved] = useState(false);
@@ -47,14 +46,14 @@ export function SaveToJournalButton({ yjs, callbackUrl, callbackToken, returnUrl
       const notes = yjs.notes.toString() || undefined;
       const gpx = generateGpx({ name: "trails.cool route", description: notes, waypoints, tracks, noGoAreas });
 
-      // POST to Journal callback
-      const response = await fetch(callbackUrl, {
+      // POST to the planner's server-side proxy. The proxy attaches the
+      // journal Bearer token (stored on the session row) and forwards
+      // the GPX. Token never leaves the planner server — see
+      // routes/api.save-to-journal.ts.
+      const response = await fetch("/api/save-to-journal", {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "Authorization": `Bearer ${callbackToken}`,
-        },
-        body: JSON.stringify({ gpx }),
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ sessionId, gpx }),
       });
 
       if (!response.ok) {
@@ -68,7 +67,7 @@ export function SaveToJournalButton({ yjs, callbackUrl, callbackToken, returnUrl
     } finally {
       setSaving(false);
     }
-  }, [yjs, callbackUrl, callbackToken]);
+  }, [yjs, sessionId]);
 
   return (
     <div className="flex items-center gap-2">