test(10-05): cover every Phase 10 Go change with branch-level tests

- bouncer TestPhase10CookieGuard: cookie read without Bearer, Bearer wins,
  empty cookie, frontend audience and blacklisted jti rejected
- boardwalk TestPhase10BoardwalkServing: HEAD, query strings, encoded
  traversal, index by name, nested prefix, MIME fallback, constructor errors
- cabana TestPhase10Coverage: mounted unsafe routes vs the CSRF walk, option
  and filter edges, read-only labels, relation message defaults, bundle
  fallback locale, cookie refresh of an expired token in the refresh window
- phrasebook override precedence, new locale, Bundle merge order, Forms shapes
- surf prefix collision for deeper paths and the default /backend prefix
- swagger2openapi TestUnionRewrite and converter branch tests
- framework tests no longer name the application (acme fixtures instead)

surf/cors_coverage_test.go

@@ -7,10 +7,10 @@ import (
 )
 
 // Gap (d): pathScopedCORS with a path matching NONE of the configured
-// globs. TestCORSPathScopedHeaders already covers the two named fonoteka
+// globs. TestCORSPathScopedHeaders already covers the two named acme
 // groups; this fixture is framework-only (/healthz vs api/*).
 
-func TestCORSPathScopedNoMatchIndependentOfFonoteka(t *testing.T) {
+func TestCORSPathScopedNoMatchIndependentOfAcme(t *testing.T) {
 	cfg := CORSConfig{
 		Paths:          []string{"api/*", "oauth/mcp/*"},
 		AllowedMethods: []string{"*"},