Session-bind /api/route and /api/overpass

Today both proxies are effectively open to anyone who can set an
Origin header for trails.cool — a third party can use us as a free
BRouter/Overpass relay. Require a live planner session on every call
so abuse traffic costs the scraper a session row (observable,
revocable) before they can issue a single query.

Server:
- New `requireSession(id)` helper — returns the session row or a 401
  Response. Reused by both route handlers.
- `/api/route`: `sessionId` in body is now required and verified;
  rate-limit key always falls back to the session id.
- `/api/overpass`: new `X-Trails-Session` header, verified. Header
  keeps the session out of the request body so the body-keyed cache
  is unaffected.

Client plumbing:
- `useRouting(yjs, sessionId)` — sessionId goes into the /api/route
  body.
- `usePois(sessionId)` → `queryPois(..., sessionId)` → `X-Trails-Session`
  on the proxy call.
- `PlannerMap` + `YjsDebugPanel` gain a `sessionId` prop from
  `SessionView`.

Journal server-to-server:
- Demo-bot and `/api/v1/routes/compute` now POST `/api/sessions` to
  mint a throwaway planner session, then cite it on the forwarded
  `/api/route` call. Planner's `expire-sessions` cron cleans these up
  (7d window) so nothing needs explicit teardown.

Tests:
- 5 unit tests for `requireSession` covering missing / empty /
  non-string / unknown-session / valid-session cases.
- Two integration E2E tests document the 401 for missing session on
  each proxy.
- Pre-existing `/api/route` integration tests updated to mint a
  session first.

Caveat: existing browser tabs lose their /api/route ability until
reload (the old JS doesn't know to send sessionId). Acceptable for
an anonymous planner.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/planner/app/routes/api.overpass.ts

@@ -1,5 +1,6 @@
 import type { Route } from "./+types/api.overpass";
 import { checkRateLimit } from "~/lib/rate-limit";
+import { requireSession } from "~/lib/require-session";
 import {
   overpassCacheEvents,
   overpassCacheSize,
@@ -169,6 +170,11 @@ export async function action({ request }: Route.ActionArgs) {
     return new Response("Forbidden", { status: 403 });
   }
 
+  // Session-bind: every proxy call must present a live planner session,
+  // so anonymous abuse traffic can't ride on our trails.cool Origin.
+  const session = await requireSession(request.headers.get("x-trails-session"));
+  if (session instanceof Response) return session;
+
   const body = await request.text();
   const cacheKey = body;
 

apps/planner/app/routes/api.route.ts

@@ -2,6 +2,7 @@ import { data } from "react-router";
 import type { Route } from "./+types/api.route";
 import { computeRoute, computeSegmentGpx, BRouterError } from "~/lib/brouter";
 import { checkRateLimit } from "~/lib/rate-limit";
+import { requireSession } from "~/lib/require-session";
 
 export async function action({ request }: Route.ActionArgs) {
   if (request.method !== "POST") {
@@ -21,9 +22,13 @@ export async function action({ request }: Route.ActionArgs) {
     return data({ error: "At least 2 waypoints are required" }, { status: 400 });
   }
 
-  // Rate limit by session ID or IP
-  const rateLimitKey = sessionId ?? request.headers.get("x-forwarded-for") ?? "unknown";
-  const limit = checkRateLimit(`route:${rateLimitKey}`);
+  // Session-bind: only live planner sessions can compute routes through
+  // us, so we don't act as an anonymous BRouter proxy for scrapers.
+  const session = await requireSession(sessionId);
+  if (session instanceof Response) return session;
+
+  // Rate limit by session ID (always present after requireSession)
+  const limit = checkRateLimit(`route:${session.id}`);
 
   if (!limit.allowed) {
     return data(