fix: harden release checks for grouped routes

backend/tests/test_sprint48_api_contract_audit.py

@@ -18,6 +18,9 @@ def test_api_contract_audit_checks_openapi_against_docs() -> None:
     content = script.read_text(encoding="utf-8")
 
     assert "create_app" in content
+    assert ".openapi()" in content
+    assert 'schema.get("paths", {})' in content
+    assert "for route in app.routes" not in content
     assert "docs/API_CONTRACTS.md" in content
     assert "Missing documented API route" in content
     assert "Documented API route is not implemented" in content