sync: capture the production server's code, which was never committed

/root/Routes-api on 31.97.228.132 is not a git repository. Work had been
done directly on the box and existed nowhere else -- a single rm -rf from
being lost, and impossible to review or roll back.

Deploying the previous HEAD over it would have silently reverted all of
this. Most visibly the Valhalla road-backend probe in main.py, whose own
comment explains why it exists: road sequencing degrades to aerial
silently by design, so an unreachable backend stays invisible, "which is
exactly how the expired Google key went unnoticed". Overwriting it would
have reintroduced precisely the failure it was written to catch, and the
service would have kept answering 200 throughout.

The server had also moved from Google Maps to Valhalla for road distance
(VALHALLA_URL, road_backend_status, +190 lines in route_optimizer),
extended docker-compose from 44 to 95 lines, and changed rider fetching,
health, dynamic config and the cache layer.

Only 10 files differ in substance. The other 27 that appeared to differ
were CRLF-vs-LF noise -- the server writes CRLF -- and are normalised to
LF here rather than committed as spurious whole-file rewrites.

Committed as-is, before any change of mine, so the diff that follows is
reviewable against what is actually running.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/services/__init__.py

@@ -15,6 +15,31 @@ except Exception:  # pragma: no cover
 logger = logging.getLogger(__name__)
 
 
+def _redis_url_from_parts() -> Optional[str]:
+    """
+    Build a redis:// URL from discrete env vars, percent-encoding the credentials.
+
+    A hand-written REDIS_URL breaks the moment the password contains a reserved
+    character: an '@' splits the authority section early, so the client silently
+    dials a garbage host instead of failing loudly. Assembling the URL here with
+    quote() removes that whole class of bug - callers set REDIS_HOST/REDIS_PASSWORD
+    and never have to think about escaping.
+
+    Returns None when REDIS_HOST is unset, so an explicit REDIS_URL still wins.
+    """
+    host = os.getenv("REDIS_HOST")
+    if not host:
+        return None
+    from urllib.parse import quote
+
+    user = os.getenv("REDIS_USERNAME", "")
+    pwd = os.getenv("REDIS_PASSWORD", "")
+    port = os.getenv("REDIS_PORT", "6379")
+    db = os.getenv("REDIS_DB", "0")
+    auth = f"{quote(user, safe='')}:{quote(pwd, safe='')}@" if pwd else ""
+    return f"redis://{auth}{host}:{port}/{db}"
+
+
 class RedisCache:
     """Lightweight Redis cache wrapper with graceful in-memory fallback."""
 
@@ -33,9 +58,10 @@ class RedisCache:
         self._client = None
         self._stats = {"hits": 0, "misses": 0, "sets": 0}
 
-        url = os.getenv(url_env)
+        url = os.getenv(url_env) or _redis_url_from_parts()
         if not url or redis is None:
-            logger.warning("Redis not configured or client unavailable; falling back to local thread-safe in-memory cache")
+            _why = "redis client not installed" if redis is None else "no REDIS_URL/REDIS_HOST"
+            logger.warning(f"Redis not configured or client unavailable ({_why}); falling back to local thread-safe in-memory cache")
             return
         try:
             self._client = redis.Redis.from_url(url, decode_responses=True)