A test requests every GET route the router registers and finds Content-Security-Policy, X-Content-Type-Options and Referrer-Policy on each answer, 404s and errors included #5859

Every GET route in both routers now has a test that requests it signed out and signed in and checks Content-Security-Policy, X-Content-Type-Options and Referrer-Policy on each answer. No route was missing a header, so no fix was needed. The new test, the router test and test/route-timing-coverage.test.ts pass, and tsc is clean. I did not run bun scripts/design-lint.ts (nothing in src/web/ changed) or the full bun test; the forge's check will run that on this push.

• Router: Router.routes() returns {method, pattern} in the order added. It is a method for tests only and adds no route.
• New test: test/security-floor-routes.test.ts seeds one repository, issue, pull, run and app. It fills each pattern's parameters from them, requests every route twice (signed out, then with a session cookie), and adds two unknown paths (/no/such/path/at/all and /api/v1/no-such-route). The file runs in about 4 s.
• Unseedable routes: 54 GET patterns need something the seed can't supply, such as origins and mirrors, migration jobs, orgs and teams, boards, looks, waves, variants, a milestone's limbs, fleet ops, secrets, share codes and archived-home ops. Each is named in UNSEEDED with a reason. They are still requested with a placeholder so their 404s are checked. A second test requires the list to match the computed set exactly, so a new route with an unfillable parameter fails until it is named.
• Router test: test/router.test.ts gains a test for routes().

What I left out: the unseeded routes are only checked on their miss path, not on a real hit. In this sandbox git is missing, so a few git-backed routes answered 500. Those 500s still carried all three headers, but the git-backed routes' success path wasn't exercised here.

Closes #5847

Every GET route in both routers now has a test that requests it signed out and signed in and checks Content-Security-Policy, X-Content-Type-Options and Referrer-Policy on each answer. No route was missing a header, so no fix was needed. The new test, the router test and test/route-timing-coverage.test.ts pass, and tsc is clean. I did not run bun scripts/design-lint.ts (nothing in src/web/ changed) or the full bun test; the forge's check will run that on this push.

• Router: Router.routes() returns {method, pattern} in the order added. It is a method for tests only and adds no route.
• New test: test/security-floor-routes.test.ts seeds one repository, issue, pull, run and app. It fills each pattern's parameters from them, requests every route twice (signed out, then with a session cookie), and adds two unknown paths (/no/such/path/at/all and /api/v1/no-such-route). The file runs in about 4 s.
• Unseedable routes: 54 GET patterns need something the seed can't supply, such as origins and mirrors, migration jobs, orgs and teams, boards, looks, waves, variants, a milestone's limbs, fleet ops, secrets, share codes and archived-home ops. Each is named in UNSEEDED with a reason. They are still requested with a placeholder so their 404s are checked. A second test requires the list to match the computed set exactly, so a new route with an unfillable parameter fails until it is named.
• Router test: test/router.test.ts gains a test for routes().

What I left out: the unseeded routes are only checked on their miss path, not on a real hit. In this sandbox git is missing, so a few git-backed routes answered 500. Those 500s still carried all three headers, but the git-backed routes' success path wasn't exercised here.