Third of four pieces from Track 3. Adds a stable, round-trip-saving
route for re-serving the original ingested audio for a run, so
clients (Phase 2 reruns, external consumers) don't have to fetch the
snapshot first to learn the artifact id.

The same bytes are reachable today via
GET /api/analysis-runs/{run_id}/artifacts/{artifact_id} (source audio
is stored as an artifact with kind='source_audio'). This new route is
an ergonomic shortcut, not a new capability:

- Stable URL (doesn't change per run; the artifact id does)
- Caller doesn't need to fetch the snapshot first
- Identical bytes, identical Content-Disposition and MIME

Auth model:

- Owner-only via _resolve_route_user_context + runtime.get_run(
  owner_user_id=...). Standard read pattern.
- Does NOT honor X-Admin-Key. Re-serving another user's audio has a
  stronger privacy posture than the cross-user delete admin bypass
  (Track 3.2). The review scoped admin to operations, not reads.
- Non-owner request returns RUN_NOT_FOUND, matching the existing
  pattern that does not disclose whether a run exists.

Error codes:

- RUN_NOT_FOUND (404) — run missing or not owned.
- SOURCE_AUDIO_NOT_FOUND (404) — defensive; would indicate the run
  row exists but source_artifact_id is null/dangling. Distinct from
  RUN_NOT_FOUND because the recovery path differs (server-side
  corruption vs ownership/typo).
- SOURCE_AUDIO_FILE_MISSING (404) — artifact row intact but bytes
  gone from disk. Distinct from SOURCE_AUDIO_NOT_FOUND because the
  recovery path differs (re-ingest vs operator look).

Files:

- apps/backend/server.py — new route between the existing artifact-
  fetch route and the spectral-enhancements route. ~85 lines.
- apps/backend/tests/test_server.py — 5 new tests in
  GetRunSourceAudioRouteTests covering: happy path with content-
  disposition; non-owner returns RUN_NOT_FOUND; unknown run returns
  RUN_NOT_FOUND; missing source artifact returns SOURCE_AUDIO_NOT_FOUND;
  missing file on disk returns SOURCE_AUDIO_FILE_MISSING.
- apps/backend/ARCHITECTURE.md — documents the new route.

Out of scope (deferred):

- Range requests / partial content for streaming. The FileResponse
  doesn't currently support Range; sufficient for the audio sizes
  ASA handles (100 MiB cap).
- Frontend UI that uses this endpoint. Phase 2 reruns are the
  intended consumer; UI wiring is a follow-up.

https://claude.ai/code/session_01Uh2eNT1oqjixcox8UX3BTg

…onsistency

Addresses PR #40 review:

1. Should fix: SOURCE_AUDIO_NOT_FOUND and SOURCE_AUDIO_FILE_MISSING
   error envelopes now carry the 'retryable' boolean per the CLAUDE.md
   contract. Both are False — corrupted run state and missing-on-disk
   bytes don't recover from a naive retry; operator action is required.

   The contract also calls for requestId and diagnostics; those are
   omitted across the existing run-management routes (ARTIFACT_NOT_FOUND,
   ARTIFACT_FILE_MISSING, AUTHENTICATION_REQUIRED), and bringing the
   whole surface into full compliance is out of scope for this PR.
   Adding retryable here keeps the new code from drifting further.

2. Worth considering: test_unknown_run_returns_404 didn't patch
   SONIC_ANALYZER_RUNTIME_PROFILE the way the other four tests in
   the class do. Functionally correct (local profile auto-assigns
   local-dev) but inconsistent. Now patches to hosted for setup
   parity.

3. Not fixed (per reviewer's 'practically unreachable'): the
   delete/fetch race that maps to SOURCE_AUDIO_NOT_FOUND instead of
   RUN_NOT_FOUND. Disambiguation requires either string-matching the
   KeyError message (fragile) or adding owner_user_id threading to
   get_source_artifact. Both are real cost for an unreachable case.

The existing SOURCE_AUDIO_NOT_FOUND / SOURCE_AUDIO_FILE_MISSING
route tests now assert the retryable field, so a future regression
(removing it) would fail.

https://claude.ai/code/session_01Uh2eNT1oqjixcox8UX3BTg