Get upcoming departures for a transport station

Anonymous access returns at most three departures per line category without a token or Developer debit. Authenticated access requires data:read and returns up to the requested response limit under the capability policy. Resolves the canonical ROOTE station ID to active provider references server-side, executes a bounded plan over established boarding relations and reconciles only proven passage occurrences. expected_at is the selected display time; coherence.timing separates nullable scheduled and predicted times and identifies stale or unknown freshness fallbacks. An all-provider failure has status error, not empty. Departure IDs no longer use display labels; consumers must treat previous IDs as unverified historical keys. Strict DTO by default; legacy requires public_contract=legacy. See /docs/PUBLIC_API_MIGRATION.md. Accepts station, stop_area, stop_point and platform ROOTE IDs, including aliases within the same canonical Station or StopPoint level. A parent queries established children, not an inferred exhaustive inventory. Response ID positions retain the requested ID for compatibility; X-ROOTE-Canonical-ID exposes the canonical target. Wrong ID type returns 400, unknown ID 404, ambiguous identity 409. Departure IDs identify qualified dated occurrences or unqualified observations, not permanent entities. Provider acquisition remains bounded; filtered results are not exhaustive. Explicit public_contract=roote-1.1.0 selects the freeze-ready whitelist and qualified EMPTY semantics; existing default/version/legacy responses remain compatible. Unknown source freshness does not establish operational availability. Internal acquisition/matching metadata is excluded from the freeze-ready projection.