Hide assigned routes until Dispatch publication

[OziinG]

Closes #416

Change control: EVNSolution/clever-change-control#289
App dependency: EVNSolution/clever-routes-app#278

Outcome

• Driver account route list, exact lookup, shared-scope lookup, and cached route-token access now hide READY routes whose current grouping child has no publishedAt timestamp.
• Existing IN_PROGRESS routes remain visible and recoverable even when historical publication metadata is missing.
• Dispatch publication remains the server-owned visibility boundary; the mobile UI is not used as a secrecy filter.
• Driver linkage, vehicle assignment, customer notification, and Dispatch idempotency are unchanged.

Scope grouping

• decision: single-pr for the server publication gate
• app UX and notification preference are split into EVNSolution/clever-routes-app PR under Assign imported orders to drivers named by dispatch files #278.
• rollback unit: server read/access gate only

Concurrent Work Gate

• decision: allowed-with-non-overlap
• target issue: Hide assigned routes from drivers until Dispatch publication #416
• change-control issue: [routes-app][server] Gate route visibility on Dispatch and simplify active-route notifications clever-change-control#289
• open PRs checked: Gate Driver release metadata on completed Play production #402, Protect Driver accounts with safe password reset links #412, Allow private S3 POD operation without a mandatory scanner #417
• Allow private S3 POD operation without a mandatory scanner #417 merged while this branch was active; it did not change the route access/token files and this branch was rebased onto current main.
• remaining open PRs do not overlap the assigned-route repository boundary.

Verification

• targeted route/token/store-review tests after rebase: 46/46 pass
• earlier full delivery-api suite: 2404 pass, 129 skipped
• Prisma generate and validate: pass
• typecheck: pass before and after rebase
• lint: pass with 6 GB Node heap
• delivery-api build: pass
• git diff --check: pass

Context decision

• This changes the server-owned driver route visibility contract. The corresponding app-side boundary is documented in docs/route-access-flow.md in the app PR.
• Production deployment and live pre-Dispatch account lookup remain separate deployment evidence.