chore: release candidate

Sprint 29, scoped to what wasn't already covered by concurrent work in
this session.

- dead code check: grepped console.log/console.debug/console.warn/
  debugger/TODO/FIXME across features/admin/** - none found. tsc
  --noUnusedLocals --noUnusedParameters over features/admin/** - clean,
  no dangling imports/params.
- verified tsc --noEmit, ng build, arch:check:boundaries, and
  arch:check:cycles all pass against the current working tree
- added CHANGELOG.md and RELEASE-NOTES.md at repo root summarizing
  Sprints 20-28

Translation validation is deliberately not duplicated here - the ~178
missing adminXxx.* i18n keys are already logged in docs/KNOWN-ISSUES.md
and being addressed there. No lint script exists in package.json, so a
lint pass isn't applicable.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+
+Format loosely follows [Keep a Changelog](https://keepachangelog.com/). Dates are commit dates on the `B2B` branch.
+
+## [Unreleased]
+
+### Added
+
+- **Category management** (`feat(admin): complete category management`) — full admin CRUD for categories: hierarchy (parent/child), drag-and-drop reorder, visibility toggle, item counter, empty-category handling, soft delete + restore, draft/publish workflow with local draft recovery, unsaved-changes guard, slug validation, translations, SEO fields, breadcrumb preview, category image via the shared media picker.
+- **Product management completion** (`feat(admin): complete product management`) — archive/restore, barcode field, lightweight variants, related-products picker, gallery via the shared media picker, discounted-price preview, infinite-scroll list mode; products now source their category list from the new category management module instead of a separate mock.
+- **Media system hardening** (`feat(media): reusable media management`) — folder tagging, tag editing, upload validation (size/type), SVG sanitization (script/event-handler stripping), automatic image compression/resize on upload; the shared media picker is now wired into category images, product gallery, and Project Editor branding (logo/compact logo/favicon).
+- **Order management** (`feat(admin): order management`) — new admin module: order list (search/status/pagination/CSV export) and detail view (customer/payment/shipping, itemized total, status timeline, change-status, refund request, cancel, customer + internal notes, print invoice). Seeded with synthetic mock orders — no backend order domain exists yet.
+- **Transaction management** (`feat(admin): transaction management`) — payments/refunds/QR transaction list derived from the mock order data, with status/type filters, retry-failed, fraud flagging, per-transaction audit log, CSV export.
+- **Users & permissions** (`feat(admin): users and permissions`) — new admin module: users (marketplace vs office admin scope), 4 built-in roles, invitations, per-user mock session list with revoke, per-user audit log. Confirms passwordless (Telegram QR) admin login was already real and links to it rather than reimplementing.
+- **Monitoring center** (`feat(admin): monitoring center`) — unified audit/security/login/failed-login/API/error/warning event feed, mock queue and webhook-delivery views, and a Health section that reuses the existing real dashboard health checks.
+- **Analytics dashboard** (`feat(admin): analytics dashboard`) — revenue/orders/average-order-value/top-products computed from the mock order data, product/category counts from their respective modules, a sales-over-time bar chart with 7/30/90-day ranges, CSV export. Visitor/funnel/heatmap sections show an explicit "awaiting backend integration" state rather than fabricated numbers, since no analytics pipeline exists.
+
+### Changed
+
+- `refactor: marketplace release polish` — accessibility pass (explicit `aria-label` on every previously-unlabeled filter `<select>` across the new admin modules), loading-skeleton consistency across admin list pages that previously rendered blank during the initial fetch, and consolidation of the admin dashboard card's custom loading shimmer onto the shared skeleton component.
+
+### Known gaps
+
+Every feature above that reads "mock/local" or "seeded" has no real backend yet — see `docs/BACKEND.md` for the full punch list (categories, products, media, orders, transactions, users/roles, and monitoring/analytics all need real endpoints before they reflect production data). `docs/ADMIN.md` documents the architecture and trade-off decisions for each module in detail.