Adds unit coverage for isV2Path, stripAPIVersion, getRouteDetail's
v2 verb mapping (POST->create, PUT->update, GET list/one,
DELETE->delete), and the v2 shadow-table write path.
Also caught a latent bug: AutoPatch synthesises a PATCH counterpart
for every PUT route in /api/v2, and both map to the 'update'
permission. The PATCH write clobbered the PUT write (last-write-wins
on the map), which would have silently broken PUT-with-API-token.
Fixed by skipping PATCH during collection — PUT remains the
authoritative update verb for tokens. JWT clients keep PATCH (it's
not gated on this table).