fix(16.3): refresh CSRF coverage golden and blog scaffold layout

Account token POST/DELETE routes made TestPhase10Coverage expect 32 unsafe
routes; token_scopes.go is hand-authored and excluded from the scaffold pin.

Co-authored-by: Cursor <cursoragent@cursor.com>

modules/cabana/phase10_coverage_test.go

@@ -89,10 +89,12 @@ func TestPhase10Coverage(t *testing.T) {
 		sort.Strings(unsafe)
 		want := []string{
 			"DELETE /account/avatar",
+			"DELETE /account/tokens/{id}",
 			"DELETE /{vendor}/{plugin}/{controller}/{id}",
 			"DELETE /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}",
 			"DELETE /{vendor}/{plugin}/{controller}/{id}/relations/{name}/records/{child}/files/{field}/{file}",
 			"POST /account/avatar",
+			"POST /account/tokens",
 			"POST /auth/login",
 			"POST /auth/logout",
 			"POST /auth/refresh",
@@ -121,7 +123,7 @@ func TestPhase10Coverage(t *testing.T) {
 			"PUT /{vendor}/{plugin}/{controller}/{id}/relations/{name}/records/{child}/files/{field}/{file}",
 		}
 		if strings.Join(unsafe, "\n") != strings.Join(want, "\n") {
-			t.Fatalf("unsafe routes changed; extend TestPhase10CSRF (it expects 30 besides login):\n%s", strings.Join(unsafe, "\n"))
+			t.Fatalf("unsafe routes changed; extend TestPhase10CSRF (it expects %d):\n%s", len(want), strings.Join(unsafe, "\n"))
 		}
 		// The routes added in Phase 10 are safe reads: GET /lang and the shared
 		// nested pattern serving field options, filter options and relation lists.