feat(roadtrip): avoid tolls, motorways and ferries, through a second engine

The switch a road tripper keeps asking for has never worked. OSRM's `exclude` is the only
avoidance TREK has, and the two public hosts it ships with answer it HTTP 400 on every
leg: their car profile is built without excludable classes, and their own Lua says why
("no memory for classes on demo server"). So "drive this without the tolls" produced
nothing at all on a default install, and the fallback inside the alternatives bar quietly
gave up after one refusal per host.

FOSSGIS runs a public Valhalla on the whole planet next to that OSRM, keyless, and there
avoidance is a runtime weighting rather than a profile that has to be rebuilt. This adds
it as a second engine asked only the questions the first cannot answer, and puts three
switches under the road trip settings that change the road itself rather than offering an
alternative beside it. Paris to Lyon measured 465.8 km / 297 min with tolls against
492.0 km / 454 min without; Hamburg to Copenhagen comes back ferry-free at 469.8 km,
which OSRM cannot produce at all — where a ferry IS the crossing it answers NoRoute
rather than driving round.

Four things the docs would have got wrong, all measured against the live instance:

- `format=osrm` does not carry `has_toll`. That flag is the entire reason for doing this,
  and it exists only in the native answer — which is also 5.7x smaller, because the OSRM
  shape drags every intersection along. So the adapter translates instead of borrowing a
  familiar envelope.
- Without a `radius` Valhalla refuses a point it cannot bind to a road, where OSRM still
  snaps one. Vienna's Stephansdom, in a pedestrian zone, answers error 442 until a search
  radius is allowed. TREK is full of such places, so every location carries one.
- Ten locations is a hard cap and a road trip day is bundled into one request. A day over
  it is split into runs overlapping by one point, which is exact rather than approximate:
  a measured six-stop day came back within two metres and under a second of the same day
  asked whole.
- Its drive times run 5.4 % above OSRM's over ten European legs and 36 % above on one, and
  those times feed the arrival clocks of a day. So a day is answered by one engine or by
  neither, never by both, and a piece that will not answer loses the whole day rather than
  half of it — the schedule chains leg times blindly and would otherwise print a complete,
  plausible, silently wrong timetable.

Because the weighting can fail, the honest surface is the answer rather than the request.
`use_tolls: 0` still returns a tolled road where there is no untolled crossing, so what
the road actually turned out to be is read back per leg, and a day that could not avoid
what it was asked to avoid says so on its own header instead of wearing a label the road
disproves. The switches disable themselves, with a reason, on an instance pointed at its
own OSRM: that operator chose against public hosts, and a second one they never asked for
would undo the choice.

Two things that would have broken quietly and did not:

- The route cache keys on `profile:unit:coords` and is shared with the day planner, the
  studio and the booking geometry. Without the avoidance in the key, flipping a switch
  returns the old road out of cache in under a millisecond — and worse, an avoiding answer
  stored under the plain key hands those other callers a road nobody drives.
- `snapped` is OSRM-only and carries the dashed kerb-to-door spur from #2273. Valhalla
  echoes the coordinates it was given and never says where it bound them, but the ends of
  a leg's line are exactly those points: measured against Füssen, its first vertex matches
  OSRM's snapped location to the digit.

The alternatives bar gets the same engine, which finally makes its "no motorway" and "no
tolls" offers appear on a default install, plus a ferry-free one. `sameRoad` now compares
geometry rather than numbers there, because two engines' distances for the same road sit
kilometres apart and the old 200 m tolerance called that a discovery.

Desktop only, like the whole road trip mode: nothing under client/src/mobile renders it.

server/src/bootstrap.ts

@@ -86,12 +86,18 @@ export async function buildApp(): Promise<INestApplication> {
   // config instead of reading process.env itself.
   const http = app.get<ConfigType<typeof httpConfig>>(httpConfig.KEY);
   // Same pre-init bridge: a self-hosted routing engine has to be named in connect-src, or
-  // the browser blocks every request to it without an error the app could report.
+  // the browser blocks every request to it without an error the app could report. Both
+  // engines go through the same door — the second one answers the avoidance questions
+  // the first cannot, and is blocked just as silently when the policy leaves it out.
   const settings = app.get(SettingsService, { strict: false });
-  const routingBase = settings?.getAdminUserDefaults()?.routing_base_url;
+  const defaults = settings?.getAdminUserDefaults();
+  const asUrl = (value: unknown) => (typeof value === 'string' ? value : null);
   applyGlobalMiddleware(instance, {
     http,
-    extraConnectSrc: routingCspOrigins([typeof routingBase === 'string' ? routingBase : null]),
+    extraConnectSrc: routingCspOrigins([
+      asUrl(defaults?.routing_base_url),
+      asUrl(defaults?.valhalla_base_url),
+    ]),
   });
   // Same pre-init consumption bridge as httpConfig above: the StorageService
   // instance is resolvable before init, and the handlers only *register* here —

server/src/middleware/globalMiddleware.ts

@@ -245,6 +245,12 @@ export function applyGlobalMiddleware(
           "https://unpkg.com", "https://open-meteo.com", "https://api.open-meteo.com",
           "https://geocoding-api.open-meteo.com", "https://api.frankfurter.dev",
           "https://router.project-osrm.org/route/v1/", "https://routing.openstreetmap.de/",
+          // The second routing engine, shipped as a default the same way the OSRM hosts
+          // above are. It is asked only when a leg should avoid tolls, motorways or a
+          // ferry — which the OSRM hosts answer with HTTP 400, because their car profile
+          // carries no excludable classes. Origin only, no path: unlike OSRM this one is
+          // a POST to /route and would grow more endpoints if isochrones ever land.
+          "https://valhalla1.openstreetmap.de",
           "https://api.mapbox.com", "https://*.tiles.mapbox.com", "https://events.mapbox.com",
           "https://tiles.openfreemap.org",
           // A self-hosted routing engine, when the instance has one configured. Without

server/src/nest/common/managed.ts

@@ -96,6 +96,7 @@ export const MANAGED_LOCKED_SETTING_KEYS = [
   'smtp_skip_tls_verify',
   'smtp_user',
   'unsplash_api_key',
+  'valhalla_base_url',
   'webauthn_origins',
   'webauthn_rp_id',
 ] as const;

server/src/nest/settings/settings.service.ts

@@ -42,6 +42,18 @@ export const DEFAULTABLE_USER_SETTING_KEYS = [
    * once at boot, and a router the policy does not name fails silently.
    */
   'routing_base_url',
+  /**
+   * The second engine, asked only what OSRM cannot answer: drive this leg without the
+   * tolls, the motorway or the ferry. The shipped OSRM hosts refuse `exclude` outright,
+   * so on a default install that question has never had an answer.
+   *
+   * Same class as the key above and for the same reason: it names an origin the BROWSER
+   * connects to, so it has to be in the boot-time connect-src, and changing it needs a
+   * restart. Empty falls back to the public Valhalla, unless routing_base_url names an
+   * own engine — an operator who chose their own router is not given a public third
+   * party they never asked for.
+   */
+  'valhalla_base_url',
   // CARTO stamps an "API KEY REQUIRED" watermark into keyless tiles (#2054), and
   // the key is per-instance rather than per-person: defaultable so one admin
   // value clears the watermark for everybody at once.
@@ -100,7 +112,7 @@ const BOOLEAN_KEYS = new Set<DefaultableKey>(['blur_booking_codes', 'mapbox_3d_e
  * on the next save instead of blocking it.
  */
 export function isAdminOnlyEndpointSetting(key: string, value: unknown): boolean {
-  if (key === 'llm_base_url' || key === 'routing_base_url') {
+  if (key === 'llm_base_url' || key === 'routing_base_url' || key === 'valhalla_base_url') {
     return typeof value === 'string' && value.trim() !== '';
   }
   if (key === 'llm_provider') return value === 'local';