docs(rest): repoint the fault-window shape comment at the anchored constants

The comment named `ALLOW_PREFIXES` and `ALLOW_SUFFIXES` as the constants its
path shapes were read off. Anchoring the allow-list replaced both, so the
reference dangled; the shapes themselves are unchanged and §0 still drives
that they are allow-listed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XTBcV7zZHmokdyQgXjbyEU

Author: claude

packages/rest/src/auth-gate-allowlist-fault-window.measurement.test.ts

@@ -187,8 +187,11 @@ async function drive(rest: RestServer, path: string, method = 'GET'): Promise<Dr
 }
 
 // The allow-list's four reachable path SHAPES, read off `auth-gate.ts` rather
-// than invented here: an `ALLOW_PREFIXES` entry, the dispatcher path shape, an
-// embedded `/auth/` segment, and an `ALLOW_SUFFIXES` entry.
+// than invented here: a REST-mounted `/auth/` route, the dispatcher path shape,
+// an environment-scoped `/auth/` route, and an exact bootstrap route.
+// (#16839 renamed the constants these were read off — `ALLOW_PREFIXES` and
+// `ALLOW_SUFFIXES` became `MOUNT_BASES` + `ALLOW_ROUTES` when the allow-list
+// was anchored — but every SHAPE below is still allow-listed, which §0 drives.)
 const ALLOWLISTED_PATHS = [
   '/api/v1/auth/change-password',
   '/auth/two-factor/enable',