tech-debt(guard): the LRO route-auth guard matches names, not semantics, and its RED case is not committed #17348

What

The route-auth guard added in #17344 (autobot-backend/api/long_running_operations_17017_test.py, test_every_route_on_this_router_declares_a_gate) is sound in its enumeration but weak in two ways that let it degrade silently in future. Found during the pre-merge review of #17344; not blocking then, because neither leaves today's routes unchecked.

The guard's enumeration is deliberately good and should be preserved: it parses the module's own source with ast rather than walking FastAPI's live route table, which makes it immune to registration style (decorator, include_router, string tuple in feature_routers.py:418, package __init__). It also carries _MIN_ROUTES_SEEN = 10 so a silent-empty enumeration fails loudly — verified exact, not padded: long_running_operations.py has exactly 10 route decorators on origin/main.

Both problems below are about the guard's resistance to regression of itself.

1. _declares_a_gate matches names and keywords, not semantics

A route passes if either:

• any decorator carries a dependencies= keyword at all — the list contents are never inspected, so dependencies=[Depends(some_unrelated_thing)] satisfies it; or
• the handler has a parameter literally named current_user — its default is never inspected, so current_user: str = Query(...) satisfies it.

So a future route can look gated to this guard while being anonymous. The guard's own docstring discloses that it is "a structural check... not that any gate actually refuses anyone", so this is a stated limitation rather than a hidden one — but it is the single way the guard can pass on an ungated route, which makes it worth closing.

2. The RED case is not committed

#17344's body describes a manual mutation test — append an ungated route, watch it fail by name, revert. That procedure is not in the suite. Nothing in CI proves _declares_a_gate still fires: loosening the current_user name check, or a typo in _ROUTE_DECORATORS, would leave the guard green and blind, and only a re-run of the manual steps would catch it.

Worth contrasting with #17347, which committed its mutation proof as two tests driving the real collisions() against a synthetic checkout, plus a mutation of its own assertion. That is the shape this one needs.

Acceptance criteria

• _declares_a_gate checks dependency and parameter values, not just presence: a dependencies= list satisfies it only if it contains an auth dependency, and a current_user parameter only if its default is Depends(get_current_user) (or the equivalent admin gate).
• A synthetic route with dependencies=[Depends(unrelated)] is asserted to FAIL the guard, and one with current_user bound to a non-auth default is asserted to FAIL.
• A committed meta-test injects a synthetic ungated function and asserts the guard fails naming that route, so the detection logic is regression-tested rather than re-verified by hand.
• _MIN_ROUTES_SEEN is left intact and still exact — raising it is correct when routes are added, lowering it to clear a red is not.