fix: harden release checks for grouped routes

scripts/audit_api_contracts.py

@@ -26,15 +26,15 @@ def _load_app_routes() -> set[tuple[str, str]]:
     sys.path.insert(0, str(BACKEND))
     from app.main import create_app
 
-    app = create_app()
+    schema = create_app().openapi()
     routes: set[tuple[str, str]] = set()
-    for route in app.routes:
-        path = getattr(route, "path", None)
-        methods = getattr(route, "methods", set())
-        if not path or path in IGNORED_OPENAPI_PATHS:
+    for path, path_item in schema.get("paths", {}).items():
+        if path in IGNORED_OPENAPI_PATHS or not isinstance(path_item, dict):
             continue
-        for method in sorted(methods - {"HEAD", "OPTIONS"}):
-            routes.add((method, path))
+        for method in path_item:
+            normalized_method = method.upper()
+            if normalized_method in {"GET", "POST", "PATCH", "DELETE"}:
+                routes.add((normalized_method, path))
     return routes