S9 (a1): slip reader — zero-API OCR

tesseract.js (self-hosted WASM, Apache-2.0) + pure per-book layout
parsers (DK/FD/MGM/Caesars) with per-field confidence and needs_review
honesty — the reader never guesses. POST /api/slips/parse (auth, free
1/day paid 10/day, 4MB cap) + Next proxy. Gated /slip page: upload or
paste, manual-correct UI, per-leg grades through the normal engine
(refusals render honestly), add-all to Parlay Lab, share card. Vision
model upgrade logged post-revenue. 2574 -> 2608 tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/app.js

@@ -187,6 +187,9 @@ app.use('/api/content', contentRoutes);
 // Session S7 (a1) — THE VYNDR REPORT: public double-opt-in subscribe
 // (forwards to the self-hosted Listmonk; graceful no-op without env).
 app.use('/api/newsletter', require('./routes/newsletter'));
+// A1 S9 — Slip Reader: OCR a bet-slip screenshot into legs (auth +
+// per-tier daily quota inside the router). Values are user-slip values.
+app.use('/api/slips', require('./routes/slips'));
 // Session 18 — internal ops endpoints (admin dashboard triggers,
 // shared-key auth via `VYNDR_INTERNAL_KEY`). Never reachable from
 // the public surface; the Next.js admin route proxies through with