Session-bind /api/route and /api/overpass

Today both proxies are effectively open to anyone who can set an
Origin header for trails.cool — a third party can use us as a free
BRouter/Overpass relay. Require a live planner session on every call
so abuse traffic costs the scraper a session row (observable,
revocable) before they can issue a single query.

Server:
- New `requireSession(id)` helper — returns the session row or a 401
  Response. Reused by both route handlers.
- `/api/route`: `sessionId` in body is now required and verified;
  rate-limit key always falls back to the session id.
- `/api/overpass`: new `X-Trails-Session` header, verified. Header
  keeps the session out of the request body so the body-keyed cache
  is unaffected.

Client plumbing:
- `useRouting(yjs, sessionId)` — sessionId goes into the /api/route
  body.
- `usePois(sessionId)` → `queryPois(..., sessionId)` → `X-Trails-Session`
  on the proxy call.
- `PlannerMap` + `YjsDebugPanel` gain a `sessionId` prop from
  `SessionView`.

Journal server-to-server:
- Demo-bot and `/api/v1/routes/compute` now POST `/api/sessions` to
  mint a throwaway planner session, then cite it on the forwarded
  `/api/route` call. Planner's `expire-sessions` cron cleans these up
  (7d window) so nothing needs explicit teardown.

Tests:
- 5 unit tests for `requireSession` covering missing / empty /
  non-string / unknown-session / valid-session cases.
- Two integration E2E tests document the 401 for missing session on
  each proxy.
- Pre-existing `/api/route` integration tests updated to mint a
  session first.

Caveat: existing browser tabs lose their /api/route ability until
reload (the old JS doesn't know to send sessionId). Acceptable for
an anonymous planner.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

e2e/integration.test.ts

@@ -59,7 +59,18 @@ test.describe("Integration: Journal ↔ Planner handoff", () => {
 });
 
 test.describe("Integration: BRouter routing", () => {
+  // Helper: mint a planner session so our /api/route calls satisfy
+  // the session-bound gate introduced alongside this test file.
+  async function createSessionId(
+    request: import("@playwright/test").APIRequestContext,
+  ): Promise<string> {
+    const resp = await request.post(`${PLANNER}/api/sessions`, { data: {} });
+    const payload = (await resp.json()) as { sessionId: string };
+    return payload.sessionId;
+  }
+
   test("computes route between Berlin waypoints", async ({ request }) => {
+    const sessionId = await createSessionId(request);
     const response = await request.post(`${PLANNER}/api/route`, {
       data: {
         waypoints: [
@@ -67,6 +78,7 @@ test.describe("Integration: BRouter routing", () => {
           { lat: 52.515, lon: 13.351 },
         ],
         profile: "trekking",
+        sessionId,
       },
     });
     expect(response.ok()).toBeTruthy();
@@ -77,6 +89,7 @@ test.describe("Integration: BRouter routing", () => {
   });
 
   test("routes through all waypoints (segment by segment)", async ({ request }) => {
+    const sessionId = await createSessionId(request);
     const response = await request.post(`${PLANNER}/api/route`, {
       data: {
         waypoints: [
@@ -85,6 +98,7 @@ test.describe("Integration: BRouter routing", () => {
           { lat: 52.510, lon: 13.390 },
         ],
         profile: "trekking",
+        sessionId,
       },
     });
     expect(response.ok()).toBeTruthy();
@@ -99,27 +113,32 @@ test.describe("Integration: BRouter routing", () => {
   });
 
   test("returns rate limit headers", async ({ request }) => {
+    const sessionId = await createSessionId(request);
     const response = await request.post(`${PLANNER}/api/route`, {
       data: {
         waypoints: [
           { lat: 52.516, lon: 13.377 },
           { lat: 52.515, lon: 13.351 },
         ],
+        sessionId,
       },
     });
     expect(response.headers()["x-ratelimit-remaining"]).toBeDefined();
   });
 
   test("rejects with fewer than 2 waypoints", async ({ request }) => {
+    const sessionId = await createSessionId(request);
     const response = await request.post(`${PLANNER}/api/route`, {
       data: {
         waypoints: [{ lat: 52.516, lon: 13.377 }],
+        sessionId,
       },
     });
     expect(response.status()).toBe(400);
   });
 
   test("returns enriched route with segment boundaries", async ({ request }) => {
+    const sessionId = await createSessionId(request);
     const response = await request.post(`${PLANNER}/api/route`, {
       data: {
         waypoints: [
@@ -128,6 +147,7 @@ test.describe("Integration: BRouter routing", () => {
           { lat: 52.510, lon: 13.390 },
         ],
         profile: "trekking",
+        sessionId,
       },
     });
     expect(response.ok()).toBeTruthy();
@@ -146,6 +166,7 @@ test.describe("Integration: BRouter routing", () => {
   });
 
   test("accepts no-go areas parameter", async ({ request }) => {
+    const sessionId = await createSessionId(request);
     const response = await request.post(`${PLANNER}/api/route`, {
       data: {
         waypoints: [
@@ -153,6 +174,7 @@ test.describe("Integration: BRouter routing", () => {
           { lat: 52.515, lon: 13.351 },
         ],
         profile: "trekking",
+        sessionId,
         noGoAreas: [
           {
             points: [
@@ -170,4 +192,28 @@ test.describe("Integration: BRouter routing", () => {
     expect(enriched.geojson.features).toHaveLength(1);
     expect(enriched.geojson.features[0].geometry.type).toBe("LineString");
   });
+
+  test("rejects /api/route without a sessionId (session-bound)", async ({ request }) => {
+    const response = await request.post(`${PLANNER}/api/route`, {
+      data: {
+        waypoints: [
+          { lat: 52.516, lon: 13.377 },
+          { lat: 52.515, lon: 13.351 },
+        ],
+        profile: "trekking",
+      },
+    });
+    expect(response.status()).toBe(401);
+  });
+
+  test("rejects /api/overpass without an X-Trails-Session header", async ({ request }) => {
+    const response = await request.post(`${PLANNER}/api/overpass`, {
+      data: "data=[out:json];node[amenity=drinking_water](52.52,13.4,52.53,13.41);out;",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Origin: PLANNER,
+      },
+    });
+    expect(response.status()).toBe(401);
+  });
 });