Remove direct public OSRM routing from Mobile

[stef-k]

Problem

WayfarerMobile directly contacts the public OSRM demonstration service during Trip and ad-hoc navigation. OsrmRoutingService hard-codes router.project-osrm.org, logs the coordinate-bearing request URL, and owns a process-local limiter. RouteCacheService stores the last response in cached_osrm_route. The demo service is not a supported production dependency and bypasses Wayfarer's server-owned routing authority.

Parent: #253. Coordinated release: stef-k/Wayfarer#505.

Product behavior

Remove every direct public-routing path from Mobile while leaving a truthful independently shippable navigation state:

• no Mobile code contacts router.project-osrm.org or another routing provider;
• saved Trip Segment geometry remains preferred and usable online or offline;
• ad-hoc Place, group-member, and map-target navigation uses honest Direct guidance;
• missing or invalid saved geometry falls back to Direct;
• Direct remains explicitly selectable and is never presented as road-aware or turn-by-turn routing;
• no partial provider geometry is blended with Direct geometry.

This issue does not add Wayfarer-hosted routing. Hosted routed guidance may be absent after this issue merges.

Current owners and required change

Inspect and narrowly update the current owners, including:

• OsrmRoutingService, its OSRM response models, timeout, limiter, retry/error handling, and coordinate-bearing URL log;
• the named Osrm HTTP client and routing registrations in MauiProgram;
• RouteCacheService, cached_osrm_route, its diagnostics, and OSRM-specific cache model;
• TripNavigationService public-OSRM/cache branches and rerouting assumptions;
• NavigationRouteBuilder and INavigationRouteBuilder OSRM/cache-specific members;
• navigation triggers from Trips/Places, context-menu map targets, and group members;
• current settings, diagnostics, tests, and documentation that claim public OSRM behavior.

Delete an owner only when it has no retained responsibility. Preserve or rename provider-independent geometry decoding, route presentation, progress/audio behavior, and Direct construction where they still have a concrete consumer.

Retained behavior and data boundaries

Retain without migration or reinterpretation:

• OfflineSegmentEntity.Geometry and downloaded Trip metadata;
• valid saved Segment geometry parsed by the shared Segment geometry path;
• ordered Segment waypoint/subedge navigation;
• NavigationRouteBuilder behavior still needed for saved geometry and Direct routes;
• PolylineDecoder only where a provider-independent current consumer remains;
• authentication, session state, Location/Timeline synchronization and cursor continuity, Trip download/use, and tolerant Trip/Place/Segment DTO handling;
• transient navigation state unrelated to the removed cache;
• credentials, Timeline data, Trip metadata, saved Segment geometry, and OSM live-tile cache.

Legacy cached_osrm_route is untrusted provider-specific residue and must not become a future Wayfarer retained route.

Cleanup and compatibility

Remove obsolete OSRM cache/preferences/settings/diagnostic fields through the smallest bounded idempotent startup/database-preference cleanup seam already used by the app. Upgrade cleanup must preserve all unrelated settings and application data. An old Mobile installation's residue may be deleted; no broad Preferences.Clear, database reset, or tile-cache cleanup is authorized.

The resulting Mobile must remain compatible with old, new, and provider-disabled Wayfarer servers because this slice makes no routing-capability or route request. Ordinary authentication, synchronization, Trips, saved geometry, and Direct guidance must not depend on hosted routing.

Failure and privacy boundaries

• Never fall back to a public or third-party provider.
• Do not log routing URLs, coordinate arrays, member identity, tokens, or credentials.
• Invalid saved geometry fails closed to Direct.
• Cancellation and navigation-local failures must not invalidate the authenticated session or disrupt synchronization.

Evidence

Use proportional TDD at the lowest stable seams. At minimum prove:

• every former public-OSRM trigger produces no third-party HTTP contact and yields saved geometry or Direct as applicable;
• valid saved Segment geometry, including ordered waypoint/subedge behavior, remains authoritative;
• missing/invalid saved geometry and ad-hoc targets yield Direct without fabricated road geometry;
• OSRM DI/client/service/cache/diagnostic ownership and coordinate-bearing logging are absent;
• legacy preference cleanup is bounded and idempotent and preserves unrelated data.

Use controlled fakes only; do not contact a provider. Run focused navigation/Core tests, then the affected mobile suite. Because DI and MAUI navigation owners change, compile Android Release. Use GitHub Actions test on the exact PR head as the merge gate. Do not create an exhaustive trigger/device/connectivity matrix or a new test harness.

Documentation and changelog

Update current navigation, service/API, architecture, privacy/security, troubleshooting, testing, user guidance, and shared changelog/release notes where they currently describe public OSRM, its cache, limiter, or availability. State that saved Segment geometry and Direct are the supported post-removal behavior until #253's later children add authenticated routing.

Exclusions

• backend changes or provider research;
• authenticated Wayfarer routing integration;
• durable retained Wayfarer route storage;
• provider credentials, SDKs, or direct provider contact;
• generic routing/storage frameworks;
• background prefetch, tile-cache changes, broad authentication/Timeline/Trip/SSE refactors;
• deployment, publication, or release authorization.

Dependency and completion

This is the first serial child of #253 and is release-blocking. It depends only on the completed prerequisites recorded by the parent. Merge and synchronize Mobile main before starting the authenticated-routing child. Completion requires reviewed code, exact-head CI success, Android compilation, documentation/changelog acceptance, and a clean synchronized main; production deployment remains owned by stef-k/Wayfarer#505.