docs: consolidate documentation and archive temporary reports

Step 1-2 (audit + plan): classified 35 project markdown files into
Core/Architecture/ADR/Temporary-audit/Sprint-report/Generated-review/
Duplicate/Obsolete/Historical. Agent-tooling files (.agents/skills/**,
.superpowers/**, docs/context/**, CLAUDE.md/GEMINI.md/AGENTS.md/
.github/copilot-instructions.md) explicitly out of scope — intentional
per-tool duplication, not documentation debt.

Step 3 (merge, no information lost):
- docs/PROJECT.md -> docs/PROJECT_INDEX.md, rewritten as the single
  entry point: system overview, living-doc index, archive pointer,
  current status, and a critical-finding callout up top.
- docs/backend/BACKEND-INTEGRATION.md -> docs/BACKEND_API.md,
  docs/backend/REMAINING-BACKEND-WORK.md ->
  docs/BACKEND_API_REMAINING_WORK.md (also folded in a legitimate
  uncommitted status update that had been sitting unstaged all
  session: categories marked DONE, order-creation endpoint noted done).
- RELEASE-NOTES.md merged into CHANGELOG.md (was a near-duplicate of
  the same release content in friendlier prose), then deleted.
- KNOWN-ISSUES.md: added item 13 (see below) and item 14 (missing
  canDeactivate on admin/products edit, from the archived PROJECT-STATE
  audit, re-verified still true); added a correction note to Fixed
  item 7.
- All cross-references to renamed/moved files fixed across every
  kept doc (grep+sed pass, then verified with a link-existence check
  across all 58 in-scope markdown files -> 0 broken links).

Step 4 (archive, nothing deleted without merging first): created
docs/archive/, moved 19 files there (3 root sprint reports, 1 platform
report, SPRINT-PLAN.md, and 14 one-off audit/review/report docs).
Added correction headers to the 3 archived docs whose conclusions were
affected by the finding below, rather than silently leaving them
misleading.

Step 5: docs/PROJECT_INDEX.md rewritten per the mission brief -
someone opening the repo should understand the whole system from it.

IMPORTANT FINDING (surfaced during this audit, not the mission's
primary goal but too significant to bury): pages/category/*,
pages/search/*, pages/item-detail/*, pages/info/**, pages/legal/**
(40+ files) are entirely unrouted dead code - app.routes.ts's
cmsContentRoutes is a literal empty array, and category/search/product
routes redirect to CatalogContainerComponent/
ProductDetailsContainerComponent, not these files. Confirmed against
app.routes.ts directly and cross-checked against FRONTEND.md's own
routing description. This means several fixes from earlier this cycle
(RC-Premium-01, RC STORE-01) and the dead-code cleanup sprint's
conclusion that these files were live were all wrong - documented as
KNOWN-ISSUES.md item 13, flagged at the top of PROJECT_INDEX.md, and
noted on the 3 archived docs whose conclusions it affects. No
application code was changed to fix this (out of scope per this
session's 'documentation only' constraint) - it needs a wire-it-up-or-
delete-it decision first.

Verification: tsc --noEmit clean, npm run build green, all markdown
links across 58 in-scope files resolve (checked programmatically).
No application/Angular/backend code modified.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/ADMIN.md

@@ -297,7 +297,7 @@ implementation) + `features/backoffice/media/` + the shared
 container/facade/service split as the rest of `admin/*`:
 
 - **No real data source exists for orders anywhere in this repo** (already
-  called out in Sprint 19's dashboard gap and `docs/backend/BACKEND-INTEGRATION.md#611-backoffice--orders-planned`) -
+  called out in Sprint 19's dashboard gap and `docs/BACKEND_API.md#611-backoffice--orders-planned`) -
   `AdminOrdersLocalGateway` seeds 24 deterministic synthetic orders in
   memory (cycling through all statuses/customers) rather than reading from
   `BackofficeDataService`, since there is nothing there to read. This is
@@ -355,14 +355,14 @@ routes at all, this is a net-new admin section.
   creates the local record.
 - **Passwordless login**: already existed before this sprint -
   `AdminAuthService`'s Telegram QR flow (`docs/ADMIN.md`'s existing admin
-  login section, `docs/backend/BACKEND-INTEGRATION.md#25-the-admin-authorization-gap-critical--security-relevant-unresolved`). This sprint's Users page links
+  login section, `docs/BACKEND_API.md#25-the-admin-authorization-gap-critical--security-relevant-unresolved`). This sprint's Users page links
   to it via a hint, doesn't reimplement it.
 - **Session manager / device manager**: per-user session list (device, IP,
   last active, current-session badge) with per-session revoke, mocked
   (`AdminUsersLocalGateway.loadSessions()` fabricates 2 sessions per user
   on first view) - the real `AdminAuthService`/session-cookie flow only
   ever tracks the *current* browser's session, so multi-device session
-  listing has no real backend counterpart yet (see `docs/backend/BACKEND-INTEGRATION.md#25-the-admin-authorization-gap-critical--security-relevant-unresolved`).
+  listing has no real backend counterpart yet (see `docs/BACKEND_API.md#25-the-admin-authorization-gap-critical--security-relevant-unresolved`).
 - **Audit**: per-user audit log (role/status changes), same dialog pattern
   as Sprint 24's per-transaction audit - not the system-wide security/audit
   log planned for Sprint 26.
@@ -492,7 +492,7 @@ final result, not just the later commit.
   multi-tenant platform - locales/categories/products/static pages are only
   known at runtime per tenant, not enumerable client-side at build time. A
   real per-tenant sitemap needs a backend/build-time generator - see
-  `docs/backend/BACKEND-INTEGRATION.md#619-sitemap-future--static-baseline-only-today`.
+  `docs/BACKEND_API.md#619-sitemap-future--static-baseline-only-today`.
 - **Responsive**: spot-checked the admin backoffice and customer-facing
   marketplace at mobile/tablet/desktop widths. `shared/ui/table` already
   wraps every admin table in `overflow-x: auto` (no changes needed); the