mrhid6
069e7e7c61
The MFA routes were missing from routeScopes and serverScopedRoutes, and both boot assertions refused to start the server. They are deliberately not reachable by API tokens, so they go in a new sessionOnlyRoutes set rather than receiving a scope, and are declared exempt from server scoping. Adds a test that registers the real routes and runs both boot assertions, so an undeclared route fails CI instead of production startup.