Session-bind /api/route and /api/overpass

Today both proxies are effectively open to anyone who can set an
Origin header for trails.cool — a third party can use us as a free
BRouter/Overpass relay. Require a live planner session on every call
so abuse traffic costs the scraper a session row (observable,
revocable) before they can issue a single query.

Server:
- New `requireSession(id)` helper — returns the session row or a 401
  Response. Reused by both route handlers.
- `/api/route`: `sessionId` in body is now required and verified;
  rate-limit key always falls back to the session id.
- `/api/overpass`: new `X-Trails-Session` header, verified. Header
  keeps the session out of the request body so the body-keyed cache
  is unaffected.

Client plumbing:
- `useRouting(yjs, sessionId)` — sessionId goes into the /api/route
  body.
- `usePois(sessionId)` → `queryPois(..., sessionId)` → `X-Trails-Session`
  on the proxy call.
- `PlannerMap` + `YjsDebugPanel` gain a `sessionId` prop from
  `SessionView`.

Journal server-to-server:
- Demo-bot and `/api/v1/routes/compute` now POST `/api/sessions` to
  mint a throwaway planner session, then cite it on the forwarded
  `/api/route` call. Planner's `expire-sessions` cron cleans these up
  (7d window) so nothing needs explicit teardown.

Tests:
- 5 unit tests for `requireSession` covering missing / empty /
  non-string / unknown-session / valid-session cases.
- Two integration E2E tests document the 401 for missing session on
  each proxy.
- Pre-existing `/api/route` integration tests updated to mint a
  session first.

Caveat: existing browser tabs lose their /api/route ability until
reload (the old JS doesn't know to send sessionId). Acceptable for
an anonymous planner.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/planner/app/components/PlannerMap.tsx

@@ -88,6 +88,7 @@ function getWaypointsFromYjs(waypoints: Y.Array<Y.Map<unknown>>): WaypointData[]
 
 interface PlannerMapProps {
   yjs: YjsState;
+  sessionId: string;
   onRouteRequest?: (waypoints: WaypointData[]) => void;
   onImportError?: (message: string) => void;
   highlightPosition?: [number, number] | null;
@@ -362,10 +363,10 @@ function PoiRefresher({ poiState }: { poiState: ReturnType<typeof usePois> }) {
   return null;
 }
 
-export function PlannerMap({ yjs, onRouteRequest, highlightPosition, highlightedWaypoint, onRouteHover, onImportError, days }: PlannerMapProps) {
+export function PlannerMap({ yjs, sessionId, onRouteRequest, highlightPosition, highlightedWaypoint, onRouteHover, onImportError, days }: PlannerMapProps) {
   const { t } = useTranslation("planner");
   const [waypoints, setWaypoints] = useState<WaypointData[]>([]);
-  const poiState = usePois();
+  const poiState = usePois(sessionId);
   useProfileDefaults(yjs, poiState);
   useYjsPoiSync(yjs, poiState);
   const [enabledOverlays, setEnabledOverlays] = useState<string[]>([]);

apps/planner/app/components/SessionView.tsx

@@ -160,7 +160,7 @@ export function SessionView({ sessionId, callbackUrl, callbackToken, returnUrl,
   const { t } = useTranslation("planner");
   useEffect(() => { Sentry.setTag("session_id", sessionId); }, [sessionId]);
   const yjs = useYjs(sessionId, initialWaypoints, initialNoGoAreas, initialNotes);
-  const { computing, routeError, routeStats, requestRoute } = useRouting(yjs);
+  const { computing, routeError, routeStats, requestRoute } = useRouting(yjs, sessionId);
   const { canUndo, canRedo, undo, redo } = useUndo(yjs?.undoManager ?? null);
   useUndoShortcuts(yjs?.undoManager ?? null);
   const days = useDays(yjs);
@@ -286,7 +286,7 @@ export function SessionView({ sessionId, callbackUrl, callbackToken, returnUrl,
                 </div>
               }
             >
-              <PlannerMap yjs={yjs} onRouteRequest={requestRoute} highlightPosition={highlightPosition} highlightedWaypoint={highlightedWaypoint} onRouteHover={setHighlightChartDistance} onImportError={(msg) => addToast(msg, "error")} days={days} />
+              <PlannerMap yjs={yjs} sessionId={sessionId} onRouteRequest={requestRoute} highlightPosition={highlightPosition} highlightedWaypoint={highlightedWaypoint} onRouteHover={setHighlightChartDistance} onImportError={(msg) => addToast(msg, "error")} days={days} />
             </Suspense>
           </div>
           <Suspense fallback={null}>
@@ -305,7 +305,7 @@ export function SessionView({ sessionId, callbackUrl, callbackToken, returnUrl,
         </main>
         <SidebarTabs yjs={yjs} routeStats={routeStats} days={days} onWaypointHover={setHighlightedWaypoint} />
       </div>
-      <YjsDebugPanel yjs={yjs} />
+      <YjsDebugPanel yjs={yjs} sessionId={sessionId} />
       {toasts.length > 0 && (
         <div className="fixed bottom-4 left-1/2 z-50 flex -translate-x-1/2 flex-col gap-2">
           {toasts.map((toast) => (

apps/planner/app/components/YjsDebugPanel.tsx

@@ -76,7 +76,7 @@ const dangerBtnClass =
  * - Actions: reset session, refetch route, become host, kick users
  * - State inspector: awareness, waypoints, route data, doc stats
  */
-export function YjsDebugPanel({ yjs }: { yjs: YjsState }) {
+export function YjsDebugPanel({ yjs, sessionId }: { yjs: YjsState; sessionId: string }) {
   const [visible, setVisible] = useState(() => loadBool("trails:debug", import.meta.env.DEV));
   const [expanded, setExpanded] = useState(() => loadBool("trails:debug:expanded", false));
   const [state, setState] = useState<DebugState | null>(null);
@@ -142,14 +142,14 @@ export function YjsDebugPanel({ yjs }: { yjs: YjsState }) {
     const response = await fetch("/api/route", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ waypoints, profile }),
+      body: JSON.stringify({ waypoints, profile, sessionId }),
     });
 
     if (response.ok) {
       const geojson = await response.json();
       yjs.routeData.set("geojson", JSON.stringify(geojson));
     }
-  }, [yjs]);
+  }, [yjs, sessionId]);
 
   const kickUser = useCallback(
     (clientId: number) => {