feat: per-stop route overrides on the /stops listing

[vbhjckfd]

offline.lad.lviv.ua and pdf.lad.lviv.ua both take ?add= / ?remove= now, but nothing produced those links — the query had to be written by hand.

What changes

The Маршрути column on GET /stops applies a stored per-stop override: removed routes red and struck through, added ones green. That row's SVG and PDF links get the matching query hung off them.

?edit=1 turns the column into controls — click a route to drop or restore it, type one into the + box to add it. Each change saves immediately.

Where the overrides live

Workers KV, under a single key holding the whole map:

{ "62": { "add": ["Т03"], "remove": ["А57"] } }

The listing renders ~1000 rows and reads this once per page load; a key per stop would be a thousand reads for a few kilobytes.

Fetched by the browser, not rendered into the page. The listing is cached at Cloudflare for 30 days — baking overrides in would mean purging it on every edit. This way the HTML stays the plain upstream listing and an edit is live at once.

Auth

PUT /stop-overrides/admin/:code sits behind Cloudflare Access. The Worker verifies the Access JWT itself — signature against the team's published keys, plus aud, iss, exp — rather than trusting that the request arrived through the proxy. Covered by tests for a forged signature, a wrong aud, a foreign iss, an expired token, alg: none, and an unknown kid.

Deploy steps (not automated)

1. npx wrangler kv namespace create STOP_OVERRIDES, put the id in worker/stop-overrides/wrangler.toml
2. Create the Access application on api.lad.lviv.ua path stop-overrides/admin; copy its AUD tag and team domain into the same file
3. npx wrangler deploy
4. Add a last-position cache rule: (http.host eq "api.lad.lviv.ua" and starts_with(http.request.uri.path, "/stop-overrides")) → Bypass cache. Cache rules do not stop at the first match, and the zone's "Cache everything" rule would otherwise serve a stale map.

Details in worker/stop-overrides/README.md.

Verified

• make test — 197 passing, 65 of them new
• Read and edit paths driven in a real browser against a stub endpoint: chip colours, link rewriting, and the PUT payloads
• The links it generates, against production: /62?add=%D0%A203&remove=%D0%9057 renders 3a 5a 55 60 80 t3 — А57 gone, Т03 added — and the PDF returns 200

Known limits

• KV is eventually consistent; a write can take ~60s to reach every edge
• Writes are read-modify-write on one key, so two people saving different stops in the same instant would lose one. One editor today
• /stops.json still reports sign and sign_pdf without overrides — it is server-rendered and cached, so applying them there would reintroduce the purge problem

🤖 Generated with Claude Code