test(admin): register operations routes in capability audit

tests/test_api_server_security.py

@@ -1568,9 +1568,23 @@ def test_capability_audit_scans_registry_and_local_sources() -> None:
     assert any(source['name'] == 'dashaflow' for source in audit['local_open_source']['sources'])
     assert all(gap.get('command') != 'varga-full' for gap in audit['priority_gaps'])
     assert audit['surfaces']['app_routes'] == [
+        'admin/administrators',
+        'admin/audit-logs',
         'admin/codes',
+        'admin/consultations',
+        'admin/credit-transactions',
+        'admin/customers',
+        'admin/feature-flags',
+        'admin/model-releases',
+        'admin/models',
+        'admin/orders',
         'admin/packages',
         'admin/payments',
+        'admin/products',
+        'admin/roles',
+        'admin/security',
+        'admin/subscriptions',
+        'admin/usage',
         'admin/users',
         'home',
         'login',