Patient API is still served on Shariant: URLS_NAME_REGISTER does not gate router URLs

🤖 Written by Claude.

Split out of the TSO 500 plan (SACGF/variantgrid_sapath#431).

`URLS_NAME_REGISTER` does not gate DRF router URLs, so Shariant still serves the patient / specimen / extraction / specimen_measure API (`api/v1/patient` etc. from #1707 and #1559). The names are in `variantgrid/settings/env/shariantcommon.py` set to `False` as intended, but only `api_specimen_measure_bulk_create` is registered through `perm_path` and therefore actually enforced; the `api_patient-list` / `-detail` style router names are ignored.

`IsAuthenticated` still applies and Shariant has no patients, so this is a tidy-up rather than an exposure — but if Shariant must genuinely not serve these, the router registration needs to honour the register (or the viewsets need to be left off the router on those deployments).

Start with URLS_NAME_REGISTER in variantgrid/settings/env/shariantcommon.py and trace the DRF router registrations for api/v1/patient, specimen, extraction, and specimen_measure. Check how api_specimen_measure_bulk_create is gated through perm_path, then make the router URLs honor the same register setting or remain unregistered when it is false. Done means Shariant no longer serves these patient and specimen API routes while the register is disabled.

Written by the indexing model from the issue text.