fix(api): declare MFA routes session-only so the server boots

The MFA routes were missing from routeScopes and serverScopedRoutes, and both
boot assertions refused to start the server. They are deliberately not
reachable by API tokens, so they go in a new sessionOnlyRoutes set rather than
receiving a scope, and are declared exempt from server scoping.

Adds a test that registers the real routes and runs both boot assertions, so
an undeclared route fails CI instead of production startup.

CLAUDE.md

@@ -746,6 +746,15 @@ purpose - the collection is `api_tokens`, the prefix is `vt_`, the routes are
 `/api/tokens`, and renaming a published endpoint to match a nav label would
 break every script already written against it.
 
+**Every `/api` route must be declared twice or the server refuses to boot**:
+once in `routeScopes` (or `sessionOnlyRoutes`) and once in `serverScopedRoutes`.
+`sessionOnlyRoutes` holds the MFA routes, which no API token may reach - a
+token that could enrol a passkey or satisfy step-up would be a way around MFA.
+They have no scope on purpose, and `RequireScopes` refuses any unmapped route
+to a token. `TestRegisteredRoutesPassBootAssertions` registers the real routes
+and runs both boot assertions, so a missing declaration fails CI rather than
+production startup.
+
 `server/internal/api/docs/openapi.json` is a **generated, committed** OpenAPI
 3.1 document - `swag v2` reading `@…` annotations off the handlers - served at
 `GET /api/openapi.json` and rendered as a reference page by a vendored Scalar