feat(roadtrip): shape the drive — vias, alternatives and stops along the way

The road-trip addon's second half: the parts that let a planned drive be
argued with rather than only read.

Reshaping. A via records which stop it follows by position, and that position
is resolved fresh every time the day is routed — so inserting, reordering or
removing a stop moved the ground under every via after it, and the drive
silently snapped back to the road it had been steered away from while the
handle still sat on the map where it was left. The correction is computed
against the day as it stands and written with the same change, in one
transaction: a half-applied re-anchoring mixes two numbering schemes in one
day. The one judgement that needs geometry — which half of a split leg a via
belongs to when a stop lands in the middle of it — is measured on the road
actually driven, so a fuel stop added to a bent leg keeps the bend on the side
it belongs to.

Alternatives. OSRM answers most long legs with exactly one route, which read as
"there is no other way" when a perfectly good slower road existed. When it
offers nothing, the same drive is asked for again without the motorway, and
failing that without the tolls — one question at a time, stopping as soon as
one lands. The offer says what it is rather than how much slower.

Stops along the way. Everything the corridor search can find is a pause, not a
destination: fuel, charging, rest areas, campsites, food and sights all sit
inside the leg they were found on, carry their own colour and icon, and are
left out of every stop count. That colour is defined once and read by the rail,
the corridor list, the map pin and the picker — and it replaced the chains'
logos, which turned a corridor full of petrol stations into a row of
advertisements and left the brands with no logo on file looking like something
else entirely.

How long a stop takes was readable in the rail and writable nowhere; new places
were given an invented hour that nobody had entered. It is now set from the
rail, cleared as a zero because the update statement folds a null into "leave
it alone", and new places start with nothing.

Both columns are rebuilt on one type scale, anchored to the day plan's own
sizes so switching tabs does not change the size of the text beside it. The
rail reads as trip totals, day cards and a chain of stops with the drives
between them; the corridor column as what to look for, how the search is
getting on, and what it found. Six category pills over three lines became one
dropdown, which is the space the results wanted.

Also: the offered routes are framed on the map when the picker opens (`fitKey`
carries no coordinates and each renderer reads it as "the selected day"), road
trip mode does not cluster at all so the whole drive stays readable zoomed out,
and the drive-time labels finally render in the app's own typeface instead of
Leaflet's Helvetica. All of it in both renderers.

server/src/middleware/globalMiddleware.ts

@@ -72,15 +72,47 @@ export function redact(value: unknown): unknown {
  * bootstrap.ts. The flag that used to switch a second parser on had exactly one
  * caller, which passed false.
  */
+/**
+ * Turns a configured routing base URL into the origin CSP needs.
+ *
+ * Only the origin: a CSP source with a path only matches that path prefix, and a router
+ * is asked at several of them (`/route/v1/...`, `/table/v1/...`). Anything that is not an
+ * absolute http(s) URL is dropped rather than passed through — a bad value in a settings
+ * row must not be able to widen the policy.
+ */
+export function routingCspOrigins(baseUrls: (string | null | undefined)[]): string[] {
+  const origins = new Set<string>();
+  for (const raw of baseUrls) {
+    if (!raw) continue;
+    try {
+      const url = new URL(raw.trim());
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') continue;
+      origins.add(url.origin);
+    } catch {
+      // Not a URL; the client falls back to the public hosts, so the policy stays as it was.
+    }
+  }
+  return [...origins];
+}
+
 export function applyGlobalMiddleware(
   app: express.Application,
-  opts: { http?: AppEnv['http'] } = {},
+  opts: {
+    http?: AppEnv['http'];
+    /**
+     * Extra origins the browser may talk to, from the instance's own settings — today the
+     * self-hosted routing engine (#1797). Read once at apply time like everything else
+     * here, so changing it takes a restart; the alternative is a database read on every
+     * request for a value that changes about once in a deployment's life.
+     */
+    extraConnectSrc?: string[];
+  } = {},
 ): void {
   // The whole pipeline is configured at APPLY time (the per-request closures
   // capture these values), so a snapshot is the correct semantic. bootstrap
   // threads in the DI-loaded httpConfig; direct callers fall back to an
   // apply-time readEnv() — same values, same freeze point.
-  const { http = readEnv().http } = opts;
+  const { http = readEnv().http, extraConnectSrc = [] } = opts;
   const { nodeEnv, isProduction } = readEnv().app;
 
   // Trust first proxy (nginx/Docker) for correct req.ip
@@ -207,7 +239,11 @@ export function applyGlobalMiddleware(
           "https://geocoding-api.open-meteo.com", "https://api.frankfurter.dev",
           "https://router.project-osrm.org/route/v1/", "https://routing.openstreetmap.de/",
           "https://api.mapbox.com", "https://*.tiles.mapbox.com", "https://events.mapbox.com",
-          "https://tiles.openfreemap.org"
+          "https://tiles.openfreemap.org",
+          // A self-hosted routing engine, when the instance has one configured. Without
+          // this the browser blocks it silently: no error the app can catch, just legs
+          // that never route (#1797).
+          ...extraConnectSrc,
         ],
         workerSrc: ["'self'", "blob:"],
         childSrc: ["'self'", "blob:"],