Uncertainty engine: Hono routes (emit, witness, calibration, orphans)

[ssilvius]

Phase 1 of the uncertainty engine spike. See docs/designs/uncertainty-engine.md.

Scope:

• apps/web/src/api/routes/uncertainty.ts
• POST /api/uncertainty/predictions -- emit
• PUT /api/uncertainty/predictions/:id/witness -- witness (idempotent, 409 if already witnessed)
• GET /api/uncertainty/calibration -- read snapshot table by surface/model/version
• GET /api/uncertainty/orphans -- orphan metrics per surface
• Mount in apps/web/src/api/app.ts
• zValidator for all input
• Auth: internal-only, ctrl-only consumer (use ctrl auth pattern)

Dependency: Drizzle schema must land first.

Tests: .test.ts unit tests for handler logic with Zocker fixtures.