test(10-05): cover every Phase 10 Go change with branch-level tests

- bouncer TestPhase10CookieGuard: cookie read without Bearer, Bearer wins,
  empty cookie, frontend audience and blacklisted jti rejected
- boardwalk TestPhase10BoardwalkServing: HEAD, query strings, encoded
  traversal, index by name, nested prefix, MIME fallback, constructor errors
- cabana TestPhase10Coverage: mounted unsafe routes vs the CSRF walk, option
  and filter edges, read-only labels, relation message defaults, bundle
  fallback locale, cookie refresh of an expired token in the refresh window
- phrasebook override precedence, new locale, Bundle merge order, Forms shapes
- surf prefix collision for deeper paths and the default /backend prefix
- swagger2openapi TestUnionRewrite and converter branch tests
- framework tests no longer name the application (acme fixtures instead)

surf/admin_prefix_test.go

@@ -28,6 +28,8 @@ func TestPhase10AdminPrefixCollision(t *testing.T) {
 		{"exact prefix", http.MethodGet, "/acme-admin", false},
 		{"under prefix", http.MethodPost, "/acme-admin/hook", false},
 		{"raw under api", http.MethodGet, "/acme-admin/api/v1/extra", true},
+		{"deeper path", http.MethodGet, "/acme-admin/a/b/c", false},
+		{"exact prefix raw", http.MethodPost, "/acme-admin", true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			app := adminPrefixApp(t)
@@ -57,9 +59,52 @@ func TestPhase10AdminPrefixCollision(t *testing.T) {
 			t.Fatalf("sibling path rejected: %v", err)
 		}
 	})
+
+	t.Run("default /backend prefix", func(t *testing.T) {
+		for _, tc := range []struct {
+			path    string
+			collide bool
+		}{
+			{"/backend", true},
+			{"/backend/deep/hook", true},
+			{"/backendx", false},
+			{"/back", false},
+			{"/api/backend", false},
+		} {
+			app := adminPrefixAppWith(t, "")
+			plugins := []party.Plugin{
+				adminPrefixPlugin{},
+				prefixRoutePlugin{id: "acme.intruder", method: http.MethodGet, path: tc.path},
+			}
+			_, err := BuildRouter(app, plugins)
+			if tc.collide && (err == nil || !strings.Contains(err.Error(), "/backend")) {
+				t.Fatalf("%s under the default prefix: err=%v", tc.path, err)
+			}
+			if !tc.collide && err != nil {
+				t.Fatalf("%s rejected next to the default prefix: %v", tc.path, err)
+			}
+		}
+	})
+
+	t.Run("no admin means no prefix check", func(t *testing.T) {
+		app := adminPrefixApp(t)
+		plugins := []party.Plugin{prefixRoutePlugin{id: "acme.site", method: http.MethodGet, path: "/acme-admin"}}
+		if _, err := BuildRouter(app, plugins); err != nil {
+			t.Fatalf("a route at the prefix without admin controllers was rejected: %v", err)
+		}
+		if err := (&Router{}).checkAdminPrefix(""); err != nil {
+			t.Fatalf("empty prefix: %v", err)
+		}
+	})
 }
 
 func adminPrefixApp(t *testing.T) *backpack.App {
+	t.Helper()
+	return adminPrefixAppWith(t, "/acme-admin")
+}
+
+// adminPrefixAppWith configures backend.uri; an empty uri keeps the default.
+func adminPrefixAppWith(t *testing.T, uri string) *backpack.App {
 	t.Helper()
 	dir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(dir, "app.yaml"), []byte("name: admin-prefix\n"), 0o644); err != nil {
@@ -68,8 +113,10 @@ func adminPrefixApp(t *testing.T) *backpack.App {
 	if err := os.WriteFile(filepath.Join(dir, "http.yaml"), []byte("body_limits:\n  default_bytes: 1024\n  upload_bytes: 1024\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dir, "backend.yaml"), []byte("uri: /acme-admin\n"), 0o644); err != nil {
-		t.Fatal(err)
+	if uri != "" {
+		if err := os.WriteFile(filepath.Join(dir, "backend.yaml"), []byte("uri: "+uri+"\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
 	}
 	cfg, err := compass.Open(compass.Options{
 		Dir:     dir,