feat(kv-bridge): Terminal KV fallback sink — POST state snapshots when Upstash ceiling hit

[kaizencycle]

Summary

Adds a warm KV bridge on OAA so the Mobius Civic AI Terminal can persist and read allowlisted hot-state keys when Upstash hits its monthly request ceiling (or other primary-KV failures). Writes are authenticated; reads and health are public so the Terminal can recover without sharing the secret on GET.

API

Method	Path	Auth	Behavior
POST	/api/kv-bridge/write	Authorization: Bearer <KV_BRIDGE_SECRET> or x-hmac-sha256 over exact JSON.stringify(req.body)	Allowlisted keys only; optional ttl_seconds
GET	/api/kv-bridge/read	none	?key= returns entry or 404; omit key for key summary
GET	/api/kv-bridge/health	none	Schema, path, key count, last write time

Files

• lib/kv-bridge/constants.ts — key allowlist
• lib/kv-bridge/store.ts — KV_BRIDGE_PATH (default data/kv-bridge.json)
• lib/kv-bridge/auth.ts — Bearer + HMAC verification
• lib/kv-bridge/giMemoryNote.ts — GI_STATE → append note to OAA_MEMORY.json (non-blocking, last 200 notes trimmed)
• pages/api/kv-bridge/{write,read,health}.ts
• lib/kv-bridge/client.ts — kvBridgeWrite / kvBridgeRead for Terminal (OAA_API_BASE_URL or OAA_API_BASE)

Env (Render / local)

• KV_BRIDGE_SECRET — required for writes (added to render.yaml for oaa-hub with generateValue: true)
• KV_BRIDGE_PATH — optional override for store file path

Repo hygiene

• data/kv-bridge.json is gitignored (runtime store; created on first write)

Tests

npm run vitest
# tests/kv-bridge.test.ts — auth, allowlist, store round-trip

Not in this PR

• lib/kv/withFallback.ts in mobius-civic-ai-terminal (separate repo) — wire Terminal to these endpoints using the same env names as lib/kv-bridge/client.ts.

Acceptance

• Write requires secret; unknown keys → 400 key_not_allowed
• Read enforces TTL when ttl_seconds set
• GI_STATE triggers OAA memory observation note when global_integrity is present
• No changes to existing unrelated API routes