fix: harden platform audit coverage

backend/api/internal/routers/platform_test.go

@@ -24,8 +24,11 @@ func TestEveryContractHasRegisteredRoute(t *testing.T) {
 		case platform.ReadOnly:
 			assertRouteMethods(t, routes, path, http.MethodGet)
 			assertRouteMethods(t, routes, path+"/:identity", http.MethodGet)
+			assertNoRouteMethods(t, routes, path, http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete)
+			assertNoRouteMethods(t, routes, path+"/:identity", http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete)
 		case platform.AppendOnly:
-			assertRouteMethods(t, routes, path, http.MethodPost)
+			assertRouteMethods(t, routes, path, http.MethodGet, http.MethodPost)
+			assertNoRouteMethods(t, routes, path, http.MethodPut, http.MethodPatch, http.MethodDelete)
 		default:
 			assertRouteMethods(t, routes, path, http.MethodGet, http.MethodPost)
 			assertRouteMethods(t, routes, path+"/:identity", http.MethodGet, http.MethodPut, http.MethodDelete)
@@ -169,3 +172,12 @@ func assertRouteMethods(t *testing.T, routes map[string]map[string]bool, path st
 		}
 	}
 }
+
+func assertNoRouteMethods(t *testing.T, routes map[string]map[string]bool, path string, methods ...string) {
+	t.Helper()
+	for _, method := range methods {
+		if routes[path][method] {
+			t.Errorf("route %s %s must not be registered", method, path)
+		}
+	}
+}