Refactor transit_api into a repo/routes module split

Split the 5,441-line index.js into an 86-line bootstrap, thin domain
route modules, shared lib/ helpers, and a repo/ layer that isolates the
DEV_MOCK branches (repo/*.mock.js). Repo methods return {statusCode, body};
routes are one-line wrappers. Pin search_path to "transit.bus" and
document the /bus/ prefix with legacy root aliases (Deprecation header).

Parity verified: 57/57 byte-identical on the stub differential harness
plus 24/24 live read-only responses vs the original against real
PostgreSQL. The only intentional behavior change: mock reorder/delete
bus-line endpoints no longer require a live DB (previously 500 in
DEV_MOCK=1 without PG). DEV_MOCK gate and node --check clean.

transit_api/routes/stops.js

@@ -0,0 +1,36 @@
+const express = require("express");
+const router = express.Router();
+const { authMiddleware, adminMiddleware } = require("../middleware");
+const repo = require("../repo");
+
+router.get("/admin/stops", authMiddleware, adminMiddleware, async (req, res) => {
+  const out = await repo.listStops(req);
+  return res.status(out.statusCode).json(out.body);
+});
+
+router.post("/admin/stops", authMiddleware, adminMiddleware, async (req, res) => {
+  const out = await repo.createStop(req);
+  return res.status(out.statusCode).json(out.body);
+});
+
+router.delete(
+  "/admin/stops/:stopId",
+  authMiddleware,
+  adminMiddleware,
+  async (req, res) => {
+    const out = await repo.deleteStop(req);
+    return res.status(out.statusCode).json(out.body);
+  },
+);
+
+router.patch(
+  "/admin/stops/:stopId",
+  authMiddleware,
+  adminMiddleware,
+  async (req, res) => {
+    const out = await repo.updateStop(req);
+    return res.status(out.statusCode).json(out.body);
+  },
+);
+
+module.exports = router;