test: narrow API route assertion to /api/ prefix pattern

Avoid broad substring matches on controller names (chat, listingsourcecode,
mcptoken) which could cause false failures if a legitimate content route
ever contains those words. The /api/ prefix is the precise invariant.

Author: BenjaminMichaelis

EssentialCSharp.Web.Tests/SitemapXmlHelpersTests.cs

@@ -49,11 +49,8 @@ public async Task GenerateSitemapXml_DoesNotIncludeApiRoutes()
 
         var allUrls = nodes.Select(n => n.Url).ToList();
 
-        // Verify no API routes are included
+        // Verify no API routes are included (assert on the /api/ pattern, not specific controller names)
         await Assert.That(allUrls).DoesNotContain(url => url.Contains("/api/", StringComparison.OrdinalIgnoreCase));
-        await Assert.That(allUrls).DoesNotContain(url => url.Contains("chat", StringComparison.OrdinalIgnoreCase));
-        await Assert.That(allUrls).DoesNotContain(url => url.Contains("listingsourcecode", StringComparison.OrdinalIgnoreCase));
-        await Assert.That(allUrls).DoesNotContain(url => url.Contains("mcptoken", StringComparison.OrdinalIgnoreCase));
     }
 
     [Test]