test(matrix): W5 resource-lifecycle block integration tests (move exempt→mapped) (#255)

Close the ten W5 resource-lifecycle routes in route_donebar_guard_test.go's
routeCoverageExemptions, moving them exempt→routeTestMap:

  GET  /api/v1/resources/families
  GET  /api/v1/resources/:id/family
  POST /api/v1/resources/:id/provision-twin
  POST /api/v1/families/bulk-twin
  POST /api/v1/resources/:id/pause
  POST /api/v1/resources/:id/resume
  POST /api/v1/resources/:id/backup
  GET  /api/v1/resources/:id/backups
  POST /api/v1/resources/:id/restore
  GET  /api/v1/resources/:id/restores

Each route's happy path + tier-gate 402 + cross-team 404 + invalid-id 400 +
bad-state 409 is already exercised by the per-handler DB-backed suites
(resource_pause_test.go, backup_test.go, twin_test.go, family_bulk_twin_test.go,
resource_family_test.go), all of which drive the route through the production
RequireAuth + PopulateTeamRole stack that testhelpers.NewTestApp /
NewTestAppWithServices rebuild from the same registrations as router.go.

Adds the genuinely-missing axis in a new block suite
(resources_lifecycle_block_integration_test.go, TestResourcesLifecycleBlock_*):
the NON-OWNER team-member role axis (these routes carry no RequireRole gate, so
a 'developer' member must drive pause/resume/backup/restore/family — the
regression that REDs if an owner-gate is ever bolted on), plus two
registry-iterating sweeps (rule 18) over lifecycleRoutes() asserting unauth 401
and cross-team 404 for every route. The twin/bulk-twin provisioning leg needs a
live postgres-customers backend; those tests assert the auth+ownership+tier
contract and skip the provisioned-row leg when the backend is unreachable
(deferred to the api/e2e live-cluster specs).

Both done-bar guards stay green. No production-source changes.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mastermanas805