test(matrix): W3 billing/api-keys/audit route coverage (move exempt→mapped)

[mastermanas805]

What

Closes the billing / api-keys / audit triage in the done-bar route guard (internal/router/route_donebar_guard_test.go): 10 routes move from routeCoverageExemptions → routeTestMap, each pointed at a real DB-backed handler-integration test.

Route	Mapped test
GET /api/v1/billing/invoices	TestBilling_ListInvoicesAPI_PortalArms_bvwave
POST /api/v1/billing/update-payment	TestBilling_UpdatePaymentMethodAPI_PortalArms_bvwave
POST /api/v1/billing/change-plan	TestBilling_ChangePlanAPI_PortalArms_bvwave (success arm = valid hobby→pro; no-downgrade/same-plan/Team-not-buyable pinned by the W3 billing-block suite #247)
GET /api/v1/billing/usage	TestBAAUsage_HappyPath_RealDB (new)
POST /api/v1/billing/promotion/validate	TestValidatePromotion_ValidCode_ReturnsDiscount
POST/GET /api/v1/auth/api-keys, DELETE /api/v1/auth/api-keys/:id	TestAPIKeys_CreateListRevoke_HappyPath
GET /api/v1/audit	TestAudit_HappyPath_ReturnsRowsForTeam
GET /api/v1/audit.csv	TestAuditCSV_Shape_HeaderAndRows

New tests

internal/handlers/billing_apikeys_audit_block_integration_test.go — a production-auth-chain layer (RequireAuth + PopulateTeamRole + RequireWritable, real session JWTs + real Postgres/Redis) covering the gaps the existing suites left:

• TestBAAApiKeys_CrossTeamIsolation_* — team B cannot see or revoke (404, not 200) team A's key.
• TestBAAApiKeys_Member_CanManageOwnTeamKeys, TestBAAApiKeys_Unauthenticated_401.
• TestBAAUsage_HappyPath_RealDB, TestBAAUsage_CrossTeamIsolation_AReflectsOnlyOwnRows, TestBAAUsage_Member_CanRead.
• TestBAAAudit_Member_CanReadOwnTeam, TestBAAAuditCSV_CrossTeamIsolation.

The Razorpay external leg (invoices/update-payment) is faked via the SetBillingPortalForTestPortal seam — a real Razorpay call is deferred to the live-cluster e2e; the API contract (success/circuit-open/razorpay-error arms) is asserted here.

Verification

• Both done-bar guards (TestDoneBar_EveryRouteCovered, TestDoneBar_TestMapPointsAtRealTests) GREEN.
• All 8 new tests + all mapped existing tests pass against a real Postgres/Redis.
• make gate: touched packages (internal/handlers, internal/router) green; full ./... reds only on documented pre-existing flakes (TestLinkGitHubID, TestGetDeploymentsExpiringSoon_*, TestGetExpiredDeployments_*) — verified identical on clean origin/master with these files stashed. CI authoritative.
• No handler-source edits — test-only change. Disjoint from test(matrix): W4 stacks-advanced block integration suite (move exempt→mapped) #256 (stacks-advanced); rebased onto origin/master, both move-sets retained.

🤖 Generated with Claude Code