As you wrote at point 1, Routing and IoC are two different things.
Once the routing engine figures out which controller has to be invoked, a "controller factory" will be invoked.
WebApi framework allows to plug your own factory as following:
GlobalConfiguration.Configuration.Services.Replace(
typeof(IHttpControllerActivator),
new WindsorCompositionRoot(this.container));
Read more on Mark Seemann post about webapi&windsor plumbing.
Which concrete will be used to satisfy a given interface dependency, that's up to the ioc you choose to use within your factory as above. Using Windsor you may/should link interfce&concrete in the Installers.
Let me try to recap the whole process 1) Set up the routing in order to link url vs controller 2) create the container and register all components using installers 3) replace default controller factory w/ a factory working w/ your favorite ioc container(Windsor, I presume :-) ) 4) Enjoy the magic.
All those steps happend in the Application_start within the Global.asax