test(matrix): W3 billing/api-keys/audit route coverage (move exempt→mapped)

Closes the 10 billing/api-keys/audit routes in the done-bar route guard's
routeCoverageExemptions, moving them to routeTestMap pointed at real DB-backed
handler-integration tests:

  - billing invoices/update-payment/change-plan → billing_portal_arms_bvwave
    (fake BillingPortal seam; success arm = valid hobby→pro; no-downgrade policy
    pinned by the W3 billing-block suite). Real Razorpay leg deferred to e2e.
  - billing/usage → new TestBAAUsage_* (production RequireAuth chain, real PG)
  - promotion/validate → TestValidatePromotion_ValidCode_ReturnsDiscount
  - api-keys create/list/revoke → TestAPIKeys_CreateListRevoke_HappyPath
  - audit read + CSV → TestAudit_HappyPath / TestAuditCSV_Shape

Adds billing_apikeys_audit_block_integration_test.go: a production-auth-chain
layer (RequireAuth + PopulateTeamRole + RequireWritable, real session JWTs +
real Postgres/Redis) covering the gaps the existing suites left — api-keys +
billing/usage cross-team isolation, non-owner-member authz, and unauth 401.

Both done-bar guards stay green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mastermanas805