ui/phase-16: cargo routes inspector + map pick foundation

Add per-planet cargo routes (COL/CAP/MAT/EMP) to the inspector with
a renderer-driven destination picker (faded out-of-reach planets,
cursor-line anchor, hover-highlight) and per-route arrows on the
map. The pick-mode primitives are exposed via `MapPickService` so
ship-group dispatch in Phase 19/20 can reuse the same surface.

Pass A — generic map foundation:
- hit-test now sizes the click zone to `pointRadiusPx + slopPx` so
  the visible disc is always part of the target.
- `RendererHandle` gains `onPointerMove`, `onHoverChange`,
  `setPickMode`, `getPickState`, `getPrimitiveAlpha`,
  `setExtraPrimitives`, `getPrimitives`. The click dispatcher is
  centralised: pick-mode swallows clicks atomically so the standard
  selection consumers do not race against teardown.
- `MapPickService` (`lib/map-pick.svelte.ts`) wraps the renderer
  contract in a promise-shaped `pick(...)`. The in-game shell
  layout owns the service so sidebar and bottom-sheet inspectors
  see the same instance.
- Debug-surface registry exposes `getMapPrimitives`,
  `getMapPickState`, `getMapCamera` to e2e specs without spawning a
  separate debug page after navigation.

Pass B — cargo-route feature:
- `CargoLoadType`, `setCargoRoute`, `removeCargoRoute` typed
  variants with `(source, loadType)` collapse rule on the order
  draft; round-trip through the FBS encoder/decoder.
- `GameReport` decodes `routes` and the local player's drive tech
  for the inline reach formula (40 × drive). `applyOrderOverlay`
  upserts/drops route entries for valid/submitting/applied
  commands.
- `lib/inspectors/planet/cargo-routes.svelte` renders the
  four-slot section. `Add` / `Edit` call `MapPickService.pick`,
  `Remove` emits `removeCargoRoute`.
- `map/cargo-routes.ts` builds shaft + arrowhead primitives per
  cargo type; the map view pushes them through
  `setExtraPrimitives` so the renderer never re-inits Pixi on
  route mutations (Pixi 8 doesn't support that on a reused
  canvas).

Docs:
- `docs/cargo-routes-ux.md` covers engine semantics + UI map.
- `docs/renderer.md` documents pick mode and the debug surface.
- `docs/calc-bridge.md` records the Phase 16 reach waiver.
- `PLAN.md` rewrites Phase 16 to reflect the foundation + feature
  split and the decisions baked in (map-driven picker, inline
  reach, optimistic overlay via `setExtraPrimitives`).

Tests:
- `tests/map-pick-mode.test.ts` — pure overlay-spec helper.
- `tests/map-cargo-routes.test.ts` — `buildCargoRouteLines`.
- `tests/inspector-planet-cargo-routes.test.ts` — slot rendering,
  picker invocation, collapse, cancel, remove.
- Extensions to `order-draft`, `submit`, `order-load`,
  `order-overlay`, `state-binding`, `inspector-planet`,
  `inspector-overlay`, `game-shell-sidebar`, `game-shell-header`.
- `tests/e2e/cargo-routes.spec.ts` — Playwright happy path: add
  COL, add CAP, remove COL, asserting both the inspector and the
  arrow count via `__galaxyDebug.getMapPrimitives()`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/frontend/src/sync/order-draft.svelte.ts

@@ -174,12 +174,20 @@ export class OrderDraftStore {
 	 * Mutations made before `init` resolves are ignored — the layout
 	 * always awaits `init` before exposing the store.
 	 *
-	 * `setProductionType` carries a collapse-by-`planetNumber` rule:
-	 * a new entry supersedes any prior `setProductionType` for the
-	 * same planet, so the draft holds at most one production choice
-	 * per planet at any time. Other variants append unconditionally —
-	 * `planetRename` keeps its append-only behaviour because each
-	 * rename is a distinct user-visible action.
+	 * Collapse rules:
+	 *
+	 *   - `setProductionType` collapses by `planetNumber`: a new
+	 *     entry supersedes any prior `setProductionType` for the
+	 *     same planet, so the draft holds at most one production
+	 *     choice per planet.
+	 *   - `setCargoRoute` and `removeCargoRoute` share a collapse
+	 *     key on `(sourcePlanetNumber, loadType)` — the engine
+	 *     stores a single (planet, type) → destination mapping, so
+	 *     a newer entry for the same slot supersedes any prior
+	 *     `set` or `remove` for that slot. Different load-types or
+	 *     different sources coexist.
+	 *   - `planetRename` and `placeholder` append unconditionally;
+	 *     each rename is a distinct user-visible action.
 	 */
 	async add(command: OrderCommand): Promise<void> {
 		if (this.status !== "ready") return;
@@ -198,6 +206,24 @@ export class OrderDraftStore {
 				nextCommands.push(existing);
 			}
 			nextCommands.push(command);
+		} else if (
+			command.kind === "setCargoRoute" ||
+			command.kind === "removeCargoRoute"
+		) {
+			nextCommands = [];
+			for (const existing of this.commands) {
+				if (
+					(existing.kind === "setCargoRoute" ||
+						existing.kind === "removeCargoRoute") &&
+					existing.sourcePlanetNumber === command.sourcePlanetNumber &&
+					existing.loadType === command.loadType
+				) {
+					removed.push(existing.id);
+					continue;
+				}
+				nextCommands.push(existing);
+			}
+			nextCommands.push(command);
 		} else {
 			nextCommands = [...this.commands, command];
 		}
@@ -444,6 +470,23 @@ function validateCommand(cmd: OrderCommand): CommandStatus {
 				return validateEntityName(cmd.subject).ok ? "valid" : "invalid";
 			}
 			return "valid";
+		case "setCargoRoute":
+			// The picker pre-checks reach (and so refuses to emit a
+			// route to an unreachable destination) and the engine
+			// re-validates ownership / reach server-side. Locally we
+			// only refuse a self-route — the FBS validator
+			// (`pkg/model/order/order.go`) accepts every other
+			// (origin, destination, load_type) triple.
+			if (cmd.sourcePlanetNumber === cmd.destinationPlanetNumber) {
+				return "invalid";
+			}
+			return "valid";
+		case "removeCargoRoute":
+			// `removeCargoRoute` carries no destination; the only
+			// engine-side check is ownership of the source planet,
+			// which the inspector enforces by only mounting the
+			// component on `kind === "local"`.
+			return "valid";
 		case "placeholder":
 			// Phase 12 placeholder entries are content-free and never
 			// transition out of `draft` — they are not submittable.