S9 (a1): slip reader — zero-API OCR

tesseract.js (self-hosted WASM, Apache-2.0) + pure per-book layout
parsers (DK/FD/MGM/Caesars) with per-field confidence and needs_review
honesty — the reader never guesses. POST /api/slips/parse (auth, free
1/day paid 10/day, 4MB cap) + Next proxy. Gated /slip page: upload or
paste, manual-correct UI, per-leg grades through the normal engine
(refusals render honestly), add-all to Parlay Lab, share card. Vision
model upgrade logged post-revenue. 2574 -> 2608 tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/src/lib/routes.js

@@ -24,6 +24,7 @@ const GATED_ROUTES = [
   '/settings',
   '/notifications',
   '/invite',
+  '/slip', // A1 S9 — slip reader (personal surface: reads the user's own bet slip)
 ];
 
 /* Open — reachable without auth (marketing + the free funnel + auth itself). */