Removing the two now-fixed stale entries (/api/chat, /api/settings/tunnels) in the
prior commit emptied the allowlist, tripping the two structural-guard tests that
assumed size > 0. An empty allowlist is a valid (ideal) state — every previously-
stale ref is fixed. Drop the non-empty assertions; keep the meaningful invariant
that any present entry is an /api/ path.