Return 404 for removed account merge admin path (#792)

ddiff --git a/server/index.js b/server/index.js
iindex 33922a3c..bfd0f2b3 100644
---- a/server/index.js
++++ b/server/index.js
@@@ -1017,6 +1017,8 @@ app.use('/api/admin/grants', requireAuth, require('./identity/grants-admin').rou
  app.use('/api/admin/themes', requireAuth, requireAdmin, require('./themes/routes').reviewRouter());
  // Operator parity checklist (WS-D task 5): where each operator job is done now, with each service's readiness.
  app.use('/api/admin/operator-checklist', requireAuth, requireAdmin, require('./admin/operator-checklist').router({ statusRows: () => require('./status/routes').rows(ecosystem) }));
++// The account merge endpoint is gone. Hide its former staff path before the broad admin guard so callers get 404.
++app.use('/api/admin/account-merges', (_req, res) => res.status(404).json({ error: 'Not found' }));
  app.use('/api/admin', createAdminRoutes(db, notificationService, emailService, requireAuth));
  
  // Analytics admin API
ddiff --git a/test/account-deletion-reauth.test.js b/test/account-deletion-reauth.test.js
iindex e738d754..718e6dc8 100644
---- a/test/account-deletion-reauth.test.js
++++ b/test/account-deletion-reauth.test.js
@@@ -114,7 +114,7 @@ assert.match(read('public/js/my/core.js'), /hash === 'delete' \? 'accounts' : ha
  // The banner reads GET /deletion on every page; that read must not spend the 20-a-minute write budget.
  const index = read('server/index.js');
  assert.match(index, /skip: \(req\) => req\.method === 'GET' && req\.path === '\/deletion'/, 'GET /deletion is not rate-limited with the writes it feeds');
--assert.doesNotMatch(index, /account-merges|account-merge/, 'account merge routes and their limiter are removed');
++assert.doesNotMatch(index, /mergeRouters|startsWith\('\/merge'\)/, 'account merge routers and their limiter are removed');
  
  // ── /login?reauth=1 always asks for the password ────────────────────────────
  const login = read('public/js/login.js');
ddiff --git a/test/unknown-paths.test.js b/test/unknown-paths.test.js
iindex 3a650141..0721db17 100644
---- a/test/unknown-paths.test.js
++++ b/test/unknown-paths.test.js
@@@ -62,6 +62,8 @@ const { ACCOUNT_HUB_PATHS } = require('../server/not-found');
          assert.strictEqual(r.status, 404, 'HEAD of an unknown path: 404');
          r = await get('/api/nope', { method: 'DELETE' });
          assert.strictEqual(r.status, 404, 'DELETE /api/nope: 404');
++        r = await get('/api/admin/account-merges', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
++        assert.strictEqual(r.status, 404, 'removed account merge admin route: 404 before the admin guard');
  
          console.log('unknown paths: all checks passed');
      } catch (err) {