BRouter host compose + Planner auth + cd-brouter rewrite

Lands sections 3-5 of the relocate-brouter-to-dedicated-host change:
everything needed to run BRouter on the dedicated Hetzner Robot host
and have the Planner talk to it with the shared-secret header. Does
NOT flip the cutover — the flagship BRouter stays warm during soak.

## BRouter host compose (section 3)

New `infrastructure/brouter-host/` — a standalone compose project that
runs as the `trails` user on `ullrich.is`:

- `docker-compose.yml` — brouter + caddy sidecar. BRouter has no host
  port; caddy binds only to `10.0.1.10:17777` (vSwitch IP). Every
  service explicitly overrides the host's default Loki logging driver
  to `json-file` so logs don't leak to the operator's personal Loki.
- `Caddyfile` — single-purpose reverse proxy that requires
  `X-BRouter-Auth: ${BROUTER_AUTH_TOKEN}` on every request. `auto_https
  off` (vSwitch-only); default access log format omits request
  headers, so the token is never written to disk.
- `download-segments.sh` — crawls brouter.de, pulls planet-wide RD5
  tiles via `wget -N` (incremental). Idempotent, safe to cron.
- `README.md` — one-shot provisioning + token rotation + rollback
  notes.

`docker/brouter/Dockerfile` is patched to honor `JAVA_OPTS` (was
hardcoded `-Xmx1024M` in CMD). Default keeps the flagship's current
heap; compose on the dedicated host overrides to `-Xmx8g` for planet
scale on a 32 GB box.

## Planner shared-secret header (section 4)

`apps/planner/app/lib/brouter.ts`:

- Module-level guard: throws at startup in production if
  `BROUTER_AUTH_TOKEN` is unset.
- `authHeaders()` helper (reads env at call time, so tests can
  `vi.stubEnv` without module reset).
- Header attached on both `computeRoute` (per-segment) and
  `computeSegmentGpx`.

3 new unit tests cover header attachment + the no-token path.

`infrastructure/docker-compose.yml` passes `BROUTER_AUTH_TOKEN` to
the Planner service, and makes `BROUTER_URL` overridable via SOPS so
the cutover is a one-variable flip.

## cd-brouter workflow (section 5)

Rewritten to deploy to the dedicated host:

- SSH as `trails@${BROUTER_DEPLOY_HOST}` on port
  `${BROUTER_DEPLOY_SSH_PORT}` (2232) using
  `${BROUTER_DEPLOY_SSH_KEY}`.
- Decrypts SOPS, extracts ONLY `BROUTER_AUTH_TOKEN` into a `.env`
  file, scp'd alongside the compose project.
- `paths:` trigger now includes `infrastructure/brouter-host/**`.
- Segment download is NOT run here — first-time seed is a manual
  operator step (multi-hour). Routine re-runs are cron-able on the
  dedicated host.
- Grafana annotation step preserved (reaches flagship Grafana as
  before).

## What's NOT here

- `brouter:` service on the flagship is intentionally left in place
  (removed in section 7.5 after the 48 h soak window post-cutover).
- Observability (section 6) — Prometheus scrape + Loki shipping from
  the dedicated host — comes in a follow-up PR.
- Cutover itself (section 7) — flip `BROUTER_URL`, verify, remove the
  flagship brouter — is an operator action gated on first-time
  provisioning + smoke testing.

## Verification

`pnpm typecheck && pnpm lint && pnpm test` all clean; planner build
passes (the CI regression from #286 was fixed in #290).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/planner/app/lib/brouter.test.ts

@@ -1,5 +1,5 @@
-import { describe, it, expect } from "vitest";
-import { mergeGeoJsonSegments } from "./brouter";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { computeRoute, computeSegmentGpx, mergeGeoJsonSegments } from "./brouter";
 
 function makeSegment(coords: number[][], length: number, ascend: number) {
   return {
@@ -221,6 +221,83 @@ describe("highway tag extraction", () => {
   });
 });
 
+describe("X-BRouter-Auth header", () => {
+  // Minimal valid response so computeRoute doesn't throw during merge.
+  const stubGeoJson = JSON.stringify({
+    type: "FeatureCollection",
+    features: [
+      {
+        type: "Feature",
+        properties: { "track-length": "100", "filtered ascend": "0", "total-time": "10" },
+        geometry: { type: "LineString", coordinates: [[13.0, 52.0, 30], [13.1, 52.1, 40]] },
+      },
+    ],
+  });
+
+  let fetchSpy: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    fetchSpy = vi.fn().mockResolvedValue(
+      new Response(stubGeoJson, { status: 200, headers: { "content-type": "application/json" } }),
+    );
+    vi.stubGlobal("fetch", fetchSpy);
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.unstubAllGlobals();
+  });
+
+  it("attaches X-BRouter-Auth when BROUTER_AUTH_TOKEN is set (computeRoute)", async () => {
+    vi.stubEnv("BROUTER_AUTH_TOKEN", "test-token-abc");
+
+    await computeRoute({
+      waypoints: [
+        { lat: 52.0, lon: 13.0 },
+        { lat: 52.1, lon: 13.1 },
+      ],
+    });
+
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    const [, init] = fetchSpy.mock.calls[0]!;
+    expect(init?.headers).toMatchObject({ "X-BRouter-Auth": "test-token-abc" });
+  });
+
+  it("omits X-BRouter-Auth when BROUTER_AUTH_TOKEN is unset (dev/test convenience)", async () => {
+    vi.stubEnv("BROUTER_AUTH_TOKEN", "");
+
+    await computeRoute({
+      waypoints: [
+        { lat: 52.0, lon: 13.0 },
+        { lat: 52.1, lon: 13.1 },
+      ],
+    });
+
+    const [, init] = fetchSpy.mock.calls[0]!;
+    expect(init?.headers).not.toHaveProperty("X-BRouter-Auth");
+  });
+
+  it("attaches X-BRouter-Auth on computeSegmentGpx as well", async () => {
+    vi.stubEnv("BROUTER_AUTH_TOKEN", "test-token-xyz");
+    fetchSpy.mockResolvedValueOnce(
+      new Response('<gpx><trk><trkseg><trkpt lat="52" lon="13"/></trkseg></trk></gpx>', {
+        status: 200,
+        headers: { "content-type": "application/gpx+xml" },
+      }),
+    );
+
+    await computeSegmentGpx({
+      waypoints: [
+        { lat: 52.0, lon: 13.0 },
+        { lat: 52.1, lon: 13.1 },
+      ],
+    });
+
+    const [, init] = fetchSpy.mock.calls[0]!;
+    expect(init?.headers).toMatchObject({ "X-BRouter-Auth": "test-token-xyz" });
+  });
+});
+
 describe("waypoint to BRouter segments", () => {
   it("splits N waypoints into N-1 pairs", () => {
     const waypoints = [

apps/planner/app/lib/brouter.ts

@@ -1,5 +1,23 @@
 const BROUTER_URL = process.env.BROUTER_URL ?? "http://localhost:17777";
 
+// The BRouter host's Caddy sidecar requires every request to carry a
+// shared-secret header. Missing in production = every request 403s, so
+// crash loudly at startup rather than during the first route request.
+if (process.env.NODE_ENV === "production" && !process.env.BROUTER_AUTH_TOKEN) {
+  throw new Error(
+    "BROUTER_AUTH_TOKEN is required in production. The BRouter Caddy " +
+      "sidecar rejects unauthenticated requests with 403. Check the " +
+      "SOPS-encrypted infrastructure/secrets.app.env and the cd-apps " +
+      "env wiring.",
+  );
+}
+
+// Read at call time so tests can stub via vi.stubEnv without module reset.
+function authHeaders(): HeadersInit {
+  const token = process.env.BROUTER_AUTH_TOKEN;
+  return token ? { "X-BRouter-Auth": token } : {};
+}
+
 export interface NoGoArea {
   points: Array<{ lat: number; lon: number }>;
 }
@@ -77,7 +95,7 @@ export class BRouterError extends Error {
 }
 
 async function fetchSegment(url: string): Promise<Record<string, unknown>> {
-  const response = await fetch(url);
+  const response = await fetch(url, { headers: authHeaders() });
   if (!response.ok) {
     const body = await response.text();
     throw new BRouterError(body.trim(), response.status);
@@ -310,7 +328,9 @@ export async function computeSegmentGpx(request: {
   const nogoParam = request.noGoAreas?.length ? noGoAreasToParam(request.noGoAreas) : undefined;
   if (nogoParam) params.set("polygons", nogoParam);
 
-  const resp = await fetch(`${BROUTER_URL}/brouter?${params}`);
+  const resp = await fetch(`${BROUTER_URL}/brouter?${params}`, {
+    headers: authHeaders(),
+  });
   if (!resp.ok) {
     const body = await resp.text();
     throw new BRouterError(body.trim(), resp.status);