sync: capture the production server's code, which was never committed

/root/Routes-api on 31.97.228.132 is not a git repository. Work had been
done directly on the box and existed nowhere else -- a single rm -rf from
being lost, and impossible to review or roll back.

Deploying the previous HEAD over it would have silently reverted all of
this. Most visibly the Valhalla road-backend probe in main.py, whose own
comment explains why it exists: road sequencing degrades to aerial
silently by design, so an unreachable backend stays invisible, "which is
exactly how the expired Google key went unnoticed". Overwriting it would
have reintroduced precisely the failure it was written to catch, and the
service would have kept answering 200 throughout.

The server had also moved from Google Maps to Valhalla for road distance
(VALHALLA_URL, road_backend_status, +190 lines in route_optimizer),
extended docker-compose from 44 to 95 lines, and changed rider fetching,
health, dynamic config and the cache layer.

Only 10 files differ in substance. The other 27 that appeared to differ
were CRLF-vs-LF noise -- the server writes CRLF -- and are normalised to
LF here rather than committed as spurious whole-file rewrites.

Committed as-is, before any change of mine, so the diff that follows is
reviewable against what is actually running.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -3,6 +3,9 @@ version: "3.9"
 networks:
   frontend:
     external: true
+  # redis + postgres-logistics live here; routes_api joins it purely to reach redis.
+  logistics:
+    external: true
 
 services:
   routes_api:
@@ -14,13 +17,20 @@ services:
     restart: unless-stopped
     environment:
       - UVICORN_WORKERS=2
-      - REDIS_URL=redis://:${REDIS_PASSWORD}@routes_redis:6379/0
+      # Redis as discrete parts, NOT a hand-built REDIS_URL: the password contains
+      # reserved characters and inlining it produced redis://:pa@ss@routes_redis/...,
+      # which resolved to a garbage host and silently fell back to in-memory cache.
+      # app/services/__init__.py percent-encodes these when assembling the URL.
+      # Host is `redis` (its container name) on the logistics network.
+      - REDIS_HOST=redis
+      - REDIS_PORT=6379
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
       # Optional: Set cache TTL in seconds (default: 300 = 5 min, 86400 = 24h)
       # Uncomment and set in .env file: REDIS_CACHE_TTL_SECONDS=86400
       # - REDIS_CACHE_TTL_SECONDS=${REDIS_CACHE_TTL_SECONDS}
-      # Google Maps API key for accurate road distance calculation (actualkms)
-      # Set in .env file: GOOGLE_MAPS_API_KEY=your_api_key_here
-      - GOOGLE_MAPS_API_KEY=${GOOGLE_MAPS_API_KEY}
+      # Self-hosted Valhalla, source of the road travel-time matrix used for
+      # road-aware stop sequencing. Unset -> sequencing falls back to aerial.
+      - VALHALLA_URL=http://routes_valhalla:8002
       # nearledb (read-only) — source for empirical ETA learning
       - DB_HOST=${DB_HOST}
       - DB_PORT=${DB_PORT}
@@ -42,3 +52,44 @@ services:
       - ./delivery_corrections.csv:/app/delivery_corrections.csv:ro
     networks:
       - frontend
+      - logistics
+
+  # Road travel-time matrix backend. Replaces the Google Distance Matrix API:
+  # no key, no per-request cost, no element cap, and a real `motorcycle` costing
+  # model instead of car durations.
+  #
+  # Deliberately NOT using tile_urls. This host has 3.8 GB RAM and runs production
+  # alongside it; building the 556 MB South India extract here risks the OOM killer
+  # taking down routes_api/postgres. Instead ./valhalla_tiles holds a pre-clipped
+  # Coimbatore PBF (bbox 76.60,10.70 -> 77.30,11.35, derived from the actual
+  # delivery coordinates in delivery_details.csv, which span only ~19 km). Valhalla
+  # builds from any .pbf it finds in /custom_files.
+  #
+  # To re-clip after an OSM refresh, on the host:
+  #   osmium extract -b 76.60,10.70,77.30,11.35 <southern-zone>.osm.pbf \
+  #     -o valhalla_tiles/coimbatore.osm.pbf
+  #   docker compose up -d --force-recreate valhalla   # with force_rebuild=True
+  valhalla:
+    image: ghcr.io/valhalla/valhalla-scripted:latest
+    container_name: routes_valhalla
+    restart: unless-stopped
+    environment:
+      - serve_tiles=True
+      - force_rebuild=False
+      - build_elevation=False
+      # India drives on the left; admin regions are what teach Valhalla that.
+      - build_admins=True
+      - build_time_zones=True
+      # Reuse built tiles on restart instead of rebuilding from the PBF.
+      - use_tiles_ignore_pbf=True
+    # Hard cap so a runaway tile build gets killed instead of the OOM killer
+    # picking off production containers on this 3.8 GB host.
+    mem_limit: 2g
+    volumes:
+      - ./valhalla_tiles:/custom_files
+    # Loopback-only: the API reaches Valhalla over the docker network, so this
+    # is purely for local probing. Valhalla has no auth — do not bind 0.0.0.0.
+    ports:
+      - "127.0.0.1:8002:8002"
+    networks:
+      - frontend