405 Responses And Allow Header

RFC 9110 §15.5.6 requires `Allow` on a 405.

Related, on the 200 path: `configureWebAnnoHeadersFor()` emits `Allow: GET,OPTIONS,HEAD,PUT,PATCH,DELETE,POST`, advertising methods some routes reject with 405.

We are noticing that the 405 response codes occur as expected but their Allow header value can be missing or incorrect. Check all instances of where a 405 is returned and the resulting 'Allow' header. Line up the 'Allow' header value with the actual list of available headers. Do not emit values that are incorrect.

Locate configureWebAnnoHeadersFor() and every code path that returns a 405. Compare each response's Allow value with the methods actually accepted by that route, including the related 200 path. Done means every 405 includes an accurate Allow header and no response advertises methods the route rejects.

Written by the indexing model from the issue text.