A test sends every mutating route a request from a foreign Origin and finds each refused before it writes

Same-origin checks on every mutation are the floor. Today they are tested route by route, not as a whole.

Done when:

[ ] A test walks every POST, PUT, PATCH and DELETE route the router registers. Each is sent signed in with a session cookie and Origin: https://evil.example, and each must answer 403 with no row written. The check reads the event log count before and after.
[ ] Bearer-token API routes, which carry no cookie, are exempt by rule. The test names that rule and proves a cookie-only request to them is refused.
[ ] Routes that cannot be called in the test are listed with why, and the list is checked.
[ ] Any route found writing is fixed in the same pull, with its own test.

A test sends every mutating route a request from a foreign Origin and finds each refused before it writes #5848