fix(roast): remove BotID availability gate

[AsperforMias]

Incident

Production BotID classified real interactive browser requests to POST /api/roast as bots and returned 403 bot_detected before the roast route reached its LLM, cache, or trace logging. This presented as an indefinitely preheating roast modal even though the model provider was healthy.

Change

• Remove the BotID client signature and server-side hard rejection from POST /api/roast only.
• Keep BotID protection for POST /api/vs-verdict.
• Preserve invalid Bearer credential rejection, scan Turnstile, roast request and generation rate limits, canonical v9 snapshot validation, cached replay, fallback-provider behavior, and the singleflight lock.
• Add route coverage proving an anonymous interactive roast is accepted while both roast limiters still execute.

Scope

No score formula, score/roast/collection version, quick-scan behavior, legacy fallback, queue/worker behavior, database schema, or cache policy changes.

Verification

• pnpm exec vitest run src/app/api/roast/route.test.ts src/app/api/vs-verdict/route.test.ts
• pnpm typecheck
• pnpm lint
• pnpm versions:check (v9/v9/v4, canonical)
• pnpm build
• pnpm test (66 files, 501 tests)
• git diff --check

Production smoke after deployment

From a normal browser, submit a roast and confirm POST /api/roast returns 200 and the event stream completes. A 403 bot_detected must no longer be possible on this endpoint; it remains expected only for the VS verdict endpoint.

[vercel]

@AsperforMias is attempting to deploy a commit to the hikariming's projects Team on Vercel.

A member of the Team first needs to authorize it.