`isAlwaysProtectedPath()` ORs two arrays — ALWAYS_PROTECTED_API_PATHS and
ALWAYS_PROTECTED_API_PATTERNS — but the gate parsed only the first, so every
route protected exclusively by a regex was reported as an annotation
mismatch. Four routes are in that position and turn the branch red:
POST /api/providers/{id}/{claude,codex}-auth/{export,apply-local}
All four are covered by the pattern added with the credential-export
hard-gate, `/^\/api\/providers\/[^/]+\/(claude|codex)-auth\/(export|apply-local)\/?$/`,
and a runtime probe over `isAlwaysProtectedPath()` returns true for all four —
the routes were never unprotected, the checker was blind to half its input.
This is the residual half of the same defect #12350 fixed for the LOCAL_ONLY
tier, which is why that arm already reads both arrays.
- parse ALWAYS_PROTECTED_API_PATTERNS and include it in the fatal parse guard,
so a future formatting change fails loudly instead of silently reverting to
false positives
- add `coveredByAlwaysProtected()` mirroring `coveredByLocalOnly()`, both
concretizing `{param}` before matching
- name both arrays in the error text, so the next mismatch says where to look
Regression test runs the gate as a subprocess (no routeGuard import, so the
unit suite gains no DB handle): red before the fix with all four routes
listed, green after.
d9b70d3c6a