test(web): hold every HTTP route to a declared auth expectation (#759)

The authorization boundary was one prefix rule plus an allowlist inside
`authMiddleware`: anything under `/api/` needs a token, everything else
does
not. A route registered outside `/api/` therefore shipped reachable
without a
token and nothing failed. The two registration sites —
`NewServerWithAuth` and
`RegisterHealthEndpoints` — each built their own mux, so neither a
reviewer nor
a test saw the whole surface at once.

This extracts the routes into one table both sites consume, with an
explicit
`public` flag per entry, and tests it four ways:

| Test | Closes |
|---|---|
| `TestRouteAuthExpectations` | replays every route through the real
middleware chain; 401 without a token unless declared public |
| `TestPublicRoutesAreExactlyDeclared` | pins the public set to a
literal list, so widening the token-free surface is a deliberate edit |
| `TestRouteRegistrationIsCentralized` | a route registered outside the
table — including inside `newMux` — would escape the replay |
| `TestAuthMiddlewarePathDecisionsMatchAllowlist` | a handler served
from the middleware itself, never registered on a mux |

**No route changed its reachability.** The table records what the code
already
did; the flags were read off the existing behaviour.

## Verification

Each gate was verified by breaking it, not by assuming it works:

- marking `/api/jobs/delete` public →
`TestRouteAuthExpectations//api/jobs/delete` and
`TestPublicRoutesAreExactlyDeclared` both fail
- registering `/sneaky` inside `newMux` → *"newMux registers a route
outside the route table"*, with the file and line
- adding a `/backdoor` path check to `authMiddleware` → the allowlist
diff names `/backdoor`

`go test ./web/` passes and golangci-lint reports 0 issues on the
package.

Author: CybotTM