feat: enforce token tag restrictions at the server resolution chokepoints

server/cmd/main.go

@@ -282,6 +282,10 @@ func serve() {
 		log.Fatalf("api scope map: %v", err)
 	}
 
+	if err := api.AssertServerScopeMapComplete(serverTouchingRoutes(r)); err != nil {
+		log.Fatalf("api server scope map: %v", err)
+	}
+
 	srv := &http.Server{Addr: ":8080", Handler: r}
 	go func() {
 		log.Println("REST server listening on :8080")
@@ -343,3 +347,22 @@ func boolEnv(key string) bool {
 	}
 	return false
 }
+
+// serverTouchingRoutes restricts AssertServerScopeMapComplete to routes whose
+// pattern names server-derived data — "server", "console" or
+// "workflows/:id/run" — rather than every routeScopes entry, so unrelated
+// routes are never swept in and boot never fails for no reason.
+func serverTouchingRoutes(r *gin.Engine) []string {
+	var out []string
+	for _, route := range r.Routes() {
+		if !strings.HasPrefix(route.Path, "/api/") {
+			continue
+		}
+		if strings.Contains(route.Path, "server") ||
+			strings.Contains(route.Path, "console") ||
+			route.Path == "/api/workflows/:id/run" {
+			out = append(out, route.Method+" "+route.Path)
+		}
+	}
+	return out
+}