fix(16.3): refresh CSRF coverage golden and blog scaffold layout

Account token POST/DELETE routes made TestPhase10Coverage expect 32 unsafe
routes; token_scopes.go is hand-authored and excluded from the scaffold pin.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/examples/blog/scaffold_layout_test.go

@@ -18,6 +18,8 @@ import (
 // this plugin (without its tests, and with migration timestamps normalised). The
 // in-repository copy has no go.mod or go.sum because it lives in the
 // framework module; those two are left out of the scaffolder's set.
+// token_scopes.go is hand-authored (HasTokenScopes example for personal API
+// tokens) and is not a make:* output, so it is left out of the walkthrough set.
 func TestScaffoldLayout(t *testing.T) {
 	// The make commands run go mod tidy; keep it on the module cache.
 	t.Setenv("GOPROXY", "off")
@@ -48,7 +50,7 @@ func TestScaffoldLayout(t *testing.T) {
 		return rel != "go.mod" && rel != "go.sum"
 	})
 	walkthrough := fileSet(t, ".", func(rel string) bool {
-		return !strings.HasSuffix(rel, "_test.go")
+		return !strings.HasSuffix(rel, "_test.go") && rel != "token_scopes.go"
 	})
 	var missing, extra []string
 	for _, f := range scaffolded {