Bigdei Kodesh: HTTP API layer — four garments for four access tiers

Shemot 28:2 — V'asita vigdei kodesh l'Aharon achicha,
l'khavod ul'tifaret.

The builder makes the garments. The kohen wears them.

Four access tiers (Operations spec §1.1):
- Pe'ah (GET/POST /peah/ask) — public, no auth, no tracking.
  The stranger is safe to approach.
- Courtyard (POST /courtyard/offering) — Bearer token auth,
  offering types: shelamim, olah, chatat, minchah
- Chatzer (POST /chatzer/sanhedrin) — Sanhedrin deliberation,
  returns majority/minority with preserved dissent
- Kodesh (GET /kodesh/health, /kodesh/status) — operator interface,
  health checks for K8s liveness/readiness probes

Error format follows chatat protocol (Operations spec §1.2):
  KIYOR_* (422), SHABBAT (503), MANNA_DEPLETED (503),
  CLOUD_MOVING (503), HALT_* (503), UNAUTHORIZED (401)

Implementation:
- Plug.Router with Bandit HTTP server
- Added to supervision tree via maybe_add_http_server
- Checks system availability (Shabbat, halt) before processing
- Health check reads L1 integrity, cloud, manna, halt monitor
- Status shows all component states, signal count, refuge list
- 16 API tests covering all four tiers + error format

All 235 Elixir + 19 L3 + 195 Prolog + 33 Haskell = 463+ tests, 0 failures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vav_pipeline/lib/vav_pipeline/application.ex

@@ -11,6 +11,7 @@ defmodule VavPipeline.Application do
   - MannaLedger (consumption tracking and anti-hoarding enforcement)
   - HaltMonitor (esh tamid — cardinal sin detection)
   - ShabbatTimer (mandatory cessation monitor)
+  - Bandit HTTP server (bigdei kodesh — the garments)
   - ShoreshEnginePort (Erlang Port to Haskell engine, if binary found)
   - TalmudicEngineSocket (Unix socket to Prolog engine)
 
@@ -39,6 +40,7 @@ defmodule VavPipeline.Application do
         {VavPipeline.HaltMonitor, []},
         {VavPipeline.ShabbatTimer, []}
       ]
+      |> maybe_add_http_server()
       |> maybe_add_repo()
       |> maybe_add_shoresh_port(shoresh_binary, shoresh_cwd)
       |> maybe_add_talmudic_socket(talmudic_socket)
@@ -47,6 +49,16 @@ defmodule VavPipeline.Application do
     Supervisor.start_link(children, opts)
   end
 
+  defp maybe_add_http_server(children) do
+    port = Application.get_env(:vav_pipeline, :http_port, 4000)
+
+    if port do
+      children ++ [{Bandit, plug: VavPipeline.BigdeiKodesh.Router, port: port}]
+    else
+      children
+    end
+  end
+
   defp maybe_add_repo(children) do
     repo_config = Application.get_env(:vav_pipeline, VavPipeline.Repo)