docs(admin): document bug-hunt audit pass over admin/products + admin/categories

Adds docs/ADMIN.md's "Bug-hunt audit pass (2026-07-17)" section (mirrors
docs/EDITOR.md's) covering both fixes from this session (dead
create-category draft recovery, duplicate-order drag-reorder) with repro
and live-verification detail, plus the one deferred finding (hardcoded
en/ru/hy translation-tab locales in both admin form components instead
of the tenant's configured supportedLocales - real cross-feature plumbing,
not a bounded fix).

Mirrors the same summary into docs/KNOWN-ISSUES.md: both bugs into
Fixed, the locale-hardcoding gap into Open as item 6.

docs/KNOWN-ISSUES.md

@@ -76,6 +76,21 @@ don't fix inline unless asked.
    auth-system check first (does one exist yet?) before building the menu.
    - Found: 2026-07-17, project-editor bug-hunt audit.
 
+6. **Admin product/category translation tabs hardcode `['en', 'ru', 'hy']`
+   instead of reading the tenant's configured `supportedLocales`.**
+   `admin-product-form.component.html` and `admin-category-form.component.html`
+   both `@for (locale of ['en','ru','hy']; ...)` over a fixed literal array
+   rather than `ProjectEditorFacade.bootstrap().localization.supportedLocales`
+   (the same source `static-pages-editor.component.ts` already reads
+   correctly). A tenant with fewer or different supported locales gets
+   translation tabs for languages it doesn't support, and no tab at all for
+   ones it does. Not fixed inline: neither `AdminProductsFacade` nor
+   `AdminCategoriesFacade` currently depends on project-editor state, so this
+   needs real cross-feature plumbing (facade -> facade -> two presentational
+   form components), not a bounded wiring fix.
+   - Found: 2026-07-17, `admin/products` + `admin/categories` bug-hunt audit
+     (`docs/ADMIN.md`'s "Bug-hunt audit pass" section).
+
 ## Fixed
 
 1. **Full-project UX/UI + motion pass across storefront, admin dashboard,
@@ -196,6 +211,29 @@ don't fix inline unless asked.
      has no runtime effect, the `dynamic-renderer/` pipeline is unwired,
      and the header's Profile toggle has no corresponding menu.
 
+6. **`admin/categories` facade: dead create-draft recovery + broken
+   drag-reorder.** Found via the same bug-hunt method as project-editor's
+   audit, applied to `admin/products` + `admin/categories`. Full detail
+   (repro steps, fix, live verification) in `docs/ADMIN.md`'s "Bug-hunt audit
+   pass (2026-07-17)" section - summary:
+   - `startCreate()` generated a fresh `category-${Date.now()}` id every
+     call and keyed the `localStorage` autosave draft off it, so create-mode
+     draft recovery could never find a match (even within the same tab,
+     seconds apart) and orphaned an entry every abandoned attempt.
+   - `reorder(id, targetOrder)` wrote the dropped-on row's `order` value
+     straight onto the dragged category, tying two siblings on the same
+     `order` instead of repositioning - and since every seeded category
+     starts at `order: 0`, every drag on fresh data was a silent no-op.
+   - Found & fixed: 2026-07-17. Each reproduced live via
+     `window.ng.getComponent()` before fixing, re-verified after (real
+     backend unreachable in this environment, so via
+     `facade.categories.set([...])` synthetic siblings feeding the same
+     facade methods/gateway calls the UI drives).
+   - One further gap found but deferred as real feature work, not a wiring
+     bug - see Open item 6 above: `admin-product-form`/`admin-category-form`
+     hardcode translation-tab locales to `['en','ru','hy']` instead of the
+     tenant's actual `supportedLocales`.
+
 ## Notes (not bugs, just flag before shipping)
 
 - `src/environments/environment.ts`: `useMockData` was temporarily flipped to