test(movements): check the allowlist against the real movements path builder

The read-path test listed a hand-written movements path; it now also builds
paths with movement::request_path, so the test fails offline if the
allowlist and the builder drift apart (Pullfrog on #80).

Claude-Session: https://claude.ai/code/session_01RqPPVeVDrnLoP7NUZmLRxY

crates/idx-core/src/api/stockbit/exodus.rs

@@ -534,6 +534,15 @@ mod tests {
         ] {
             assert!(is_read_path(path), "{path}");
         }
+        // Paths another module builds come from its own builder, so the
+        // allowlist cannot drift from them.
+        let query = MovementQuery::default();
+        for path in [
+            movement::request_path(&query, None, 1),
+            movement::request_path(&query, Some("BBCA"), 3),
+        ] {
+            assert!(is_read_path(&path), "{path}");
+        }
         for path in [
             "/order/buy",
             "/login/refresh",