Session 45: Snapshot pipeline + GameCard swap + live ticker (2100 tests)

The on-demand "Read" grade model is RETIRED. A scheduled pipeline pre-grades the
slate, locks grades to the line, tracks movement; the dashboard shows them already
there. Orchestrates existing services — nothing rebuilt.

- snapshotService.runSnapshot(sport): getOdds → gradeAndCacheSlate → classify
  archetype per player → lock gradedAt → line deltas vs previous snapshot → write
  snapshot:{sport}:latest/previous + grades:{sport} → ticker events. Fully
  injectable, zero-network unit tests. runAllSnapshots = cron entrypoint.
- Internal trigger POST /api/internal/snapshot/:sport + /all (requireInternalAuth).
  In-process cron (SNAPSHOT_CRON=1, UTC 14,19,22,1,3) in server.js, no new dep.
- Public reads: GET /api/snapshot/:sport (cache-only) + GET /api/ticker (merges
  TICKER_MANUAL pins) + Next proxies.
- GameCard swap: live Slate renders vyndr/GameCard (legacy kept for types only),
  overlays locked grades onto game props → player name once + archetype badge +
  "Graded Xh ago at -115 · Current 2.5 · ▲ TOWARD +1.0". Ungraded → "Awaiting next
  scan", NO Read button. On-demand onGrade flow deleted.
- Ticker polls /api/ticker every 30s, graceful fallback to hardcoded items.
- NBA/WNBA: espnStatsAdapter free fallback (defensive parse → found:false on shape
  mismatch) wired into resolvePlayerStats after the offline Python service.

Env: PROPLINE_API_KEY_1/2/3, VYNDR_INTERNAL_KEY, SNAPSHOT_CRON=1, TICKER_MANUAL.
Backend 2061 -> 2100 tests (+39), 173 suites. Web build clean (exit 0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/routes/internal.js

@@ -82,4 +82,38 @@ router.post('/prefetch/tank01', async (req, res) => {
   }
 });
 
+/**
+ * POST /api/internal/snapshot/:sport (Session 45)
+ *
+ * Trigger one snapshot cycle for a sport (pre-grade the slate, lock grades,
+ * compute deltas, emit ticker events). Internal-only (requireInternalAuth at the
+ * router root). This is what the cron / n8n schedule calls — never public, so a
+ * bad actor can't drain the PropLine quota by spamming it.
+ */
+/** POST /api/internal/snapshot/all — every active sport, sequentially.
+ *  Registered BEFORE /snapshot/:sport so "all" isn't captured as a sport. */
+router.post('/snapshot/all', async (req, res) => {
+  const snapshot = require('../services/snapshotService');
+  try {
+    const results = await snapshot.runAllSnapshots();
+    return res.json({ ok: true, results });
+  } catch (err) {
+    const message = err && err.message ? err.message : String(err);
+    console.error('[internal/snapshot/all] failed:', message);
+    return res.status(500).json({ ok: false, error: message });
+  }
+});
+
+router.post('/snapshot/:sport', async (req, res) => {
+  const snapshot = require('../services/snapshotService');
+  try {
+    const summary = await snapshot.runSnapshot(req.params.sport);
+    return res.json({ ok: true, summary });
+  } catch (err) {
+    const message = err && err.message ? err.message : String(err);
+    console.error('[internal/snapshot] failed:', message);
+    return res.status(500).json({ ok: false, error: message });
+  }
+});
+
 module.exports = router;