feat(control-plane): expose route decision explanations

[Wibias]

Summary

RI-09 of the Router Intelligence / Routing Control Plane programme. Exposes
why-this-route explanations from the durable trace + attempt history:

• GET /api/request-history/:requestId/route-decision - requested model,
  route kind, profile + revision, requirements, candidates with exclusions
  and score components, selected candidate + tie-break, actual attempt
  sequence, and final outcome.
• GET /api/routing-profiles (RI-04) and POST /api/routing-profiles/dry-run
  remain the profile inspection surfaces; the dry-run endpoint now also
  assembles canonical capability/health/quota/cost evidence when no candidate
  evidence is supplied ("evaluate" mode).
• CLI: ocx logs explain <request-id> and ocx route policy evaluate <profile> (an alias of dry-run with auto-evidence).

The API returns stable structured codes + display-ready summaries - never
localized prose as the only contract.

Scope

• src/server/management/request-history-routes.ts - the
  /route-decision subroute (checked before the generic :requestId
  branch): merges the persisted RI-01 trace, the execution attempts[], and
  a summary/outcome block. Pre-trace rows answer with routeDecision: null
  and their attempts/outcome (honest, not fabricated).
• src/server/management/routing-profile-routes.ts - dry-run auto-evidence:
  candidates omitted -> canonical capability (catalog/registry/native),
  health (index), quota (caches), cost (price model + profile limit)
  evidence per profile candidate.
• src/cli/observe.ts - ocx logs explain <id> [--json].
• src/cli/route-policy.ts - ocx route policy evaluate <id> [--json].
• tests/route-explainability.test.ts - 4 tests.

Privacy / security

• The explanation surfaces only data already bounded by the trace and the
  usage entry: no prompts, credentials, or raw responses.
• bun run privacy:scan passes.

Compatibility

• Additive endpoints and CLI subcommands; /api/logs and /api/request-history
  unchanged.

Dependency

• Stacked on RI-01..RI-08 (feat(routing): record durable route decision traces #1003, feat(control-plane): add indexed cursor-paginated request history #1004, feat(analytics): add route reliability and latency analytics #1005, feat(routing): add validated routing policy profiles #1011, feat(routing): execute capability-aware policy profiles #1012, feat(routing): add evidence-based route health scoring #1013, feat(routing): add quota-aware policy scoring #1014,
  feat(routing): add cost-aware policy scoring and limits #1015). Branch base: feat/ri-08-cost-aware-routing head 66ae44aca.

Non-goals

• No GUI (RI-10).
• No localized prose as the API contract (stable codes + summaries only).

Local verification (exact)

• bun x tsc --noEmit -> PASSED (0 errors)
• bun run test tests/route-explainability.test.ts -> 4/4 pass
• Focused regression suites -> 70/70 pass across 8 files
• bun run privacy:scan -> passed

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fa7ba5b4-2eb7-437c-9f29-b1d86a70c50e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}