docs: add code-audit improvement suggestions

[i11v]

What

Adds docs/IMPROVEMENTS.md — a full code audit of the repo with 33 verified findings, written so each suggestion is a self-contained task (problem statement, quoted code, concrete fix sketch, acceptance criteria, effort estimate) that can be picked up and implemented independently, including by a smaller model.

Scope of the audit

• packages/worker (8 findings: WKR-01…08) — Durable Objects, gateway caching, Golemio client
• packages/web (13 findings: WEB-01…13) — React app, WS hook, URL/state handling, accessibility
• Contract, scripts, CI, tooling (12 findings: TLG-01…12) — stop-index build, GTFS caching, workflows, lefthook

Every claim was verified against the actual code (and where relevant, by executing the code in question); a closing section lists things that were examined and deliberately not flagged, to save future auditors time.

Highlights (fix-first list)

• WEB-01 — selecting a whole multi-name stop force-pins one platform and silently hides the other platforms' departures
• WEB-02 — a hand-edited ?s= URL bypasses the wire-protocol caps and wedges the WebSocket feed
• TLG-01 — a NaN coordinate passes the build-time schema check but serializes to null, shipping a client-breaking stop index through green CI
• WKR-01 — an integration test asserts 400 where the worker now returns 426, unnoticed because test:integration isn't wired into CI
• WKR-02 — ClientSession DO storage leaks (retained and billed indefinitely) when a socket disconnects without a close frame
• TLG-03 — a corrupt-but-200 GTFS download overwrites the last-good cache before validation, defeating the outage fallback

Baseline at audit time: typecheck, lint, and all 82 unit tests green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WgpPdTSGKeydeG9Xqb8Sqv

---

Generated by Claude Code

[github-actions]

🚀 Preview deployed: https://preview-27.tablo.run
_{fallback: https://tablo-pr-27.i11v.workers.dev}