docs: final project closeout - classify TODO, backend spec, status

Classified every TODO.md item into one of DONE/BACKEND/PRODUCT
DECISION/FUTURE VERSION/BUG, verified against source, not against
prior docs:

- BACKEND items (bootstrap content, builder draft/publish, 6 admin
  CRUD domains, media pipeline) confirmed already covered by
  BACKEND_INTEGRATION.md; appended a mapping appendix rather than
  duplicating raw bullets. Fixed 22 stale internal BACKEND_API.md
  cross-references left over from before that file was archived.
- PRODUCT DECISION items (dark mode, brand-color WCAG contrast,
  stars.component token gap, footer Contacts content, advanced
  analytics, payment providers) moved to new docs/PRODUCT_BACKLOG.md.
- FUTURE VERSION items (Angular 22, bundle splitting, cart-modal
  composition cleanup, hero-spacing investigation) moved to new
  docs/FUTURE_FEATURES.md.
- BUG: rewrote docs/KNOWN-ISSUES.md down to the one real, verified,
  currently-reproducible frontend bug (Ed25519 admin-auth error codes
  session-expired/invalid-signature are unreachable -
  toAuthErrorShape() never reads a body error code, only maps HTTP
  status, and no status ever produces those two codes - confirmed by
  reading auth.service.ts + auth-error.model.ts). Condensed the
  "Fixed" history instead of carrying full verbose repro text forward.
- DONE items removed outright (dead-code deletion, dashboard false
  positive, RC-02 fixes, stale "dynamic-renderer unwired"/"178 missing
  keys" claims already disproven by source).

docs/TODO.md rewritten to the exact "no blockers" template - nothing
left qualifies as a release blocker.

New docs/PROJECT_STATUS.md: honest per-area status (frontend/backend/
docs/auth/builder/storefront/admin), known limitations, and explicit
production/backend/demo readiness calls - including correcting an
initial draft's unpushed-commit count (53, not 10, per git log
origin/B2B..HEAD).

New docs/NEXT_PHASE.md: work that can only start once a real backend
exists (gateway swap-in, mock removal, dormant-auth activation, role
enforcement, integration/E2E tests, perf profiling, monitoring,
maintenance-mode UI).

docs/PROJECT_INDEX.md (the stated entry point) updated to link the new
doc set and stop pointing at the now-archived BACKEND_API.md/AUTH.md.
docs/FRONTEND-ROADMAP.md's "Known open items" replaced with pointers
to the new category-split docs instead of a duplicated mixed list.

Not swept: a handful of low-traffic docs (architecture ADRs,
FRONTEND.md, EDITOR.md, ARCHITECTURE.md, PROJECT-STRUCTURE.md,
StaticPages.md, ADMIN.md) still reference the old BACKEND_API.md/
AUTH.md filenames - noted as a known gap in PROJECT_STATUS.md rather
than touched blindly, since they're historical-context docs, not the
navigation entry point.

docs/BACKEND_INTEGRATION.md

@@ -1,6 +1,6 @@
 # Backend Integration — Canonical Specification
 
-**This is the single source of truth for backend implementation.** It supersedes and merges `docs/BACKEND_API.md`, `docs/AUTH.md`, `docs/ADMIN.md`, and `docs/BACKEND_API_REMAINING_WORK.md` (all archived — see `docs/archive/` and the note at the end of this file). It incorporates `docs/AUTHENTICATION.md` (§4) and `docs/ERROR_CONTRACT.md` (§6) in full; those files remain in place as standalone references but this document is authoritative. `docs/MAINTENANCE_MODE.md` is a companion doc, referenced from §6.
+**This is the single source of truth for backend implementation.** It supersedes and merges `docs/archive/BACKEND_API.md`, `docs/AUTH.md`, `docs/ADMIN.md`, and `docs/BACKEND_API_REMAINING_WORK.md` (all archived — see `docs/archive/` and the note at the end of this file). It incorporates `docs/AUTHENTICATION.md` (§4) and `docs/ERROR_CONTRACT.md` (§6) in full; those files remain in place as standalone references but this document is authoritative. `docs/MAINTENANCE_MODE.md` is a companion doc, referenced from §6.
 
 Everything here is derived from the actual current frontend source code (branch `B2B`), not from prior/stale documentation. Primary input: `docs/context/BACKEND-AUDIT.md` (exhaustive audit of every HTTP call, gateway, facade, and model in the frontend).
 
@@ -34,7 +34,7 @@ Source of truth for this section:
 `src/app/core/config/tenant-resolver.service.ts`,
 `src/app/shared/models/config/*`, and the mock document
 `src/assets/mock/bootstrap/bootstrap.json`. Cross-referenced against
-`docs/context/BACKEND-AUDIT.md` §6, §2 and the prior `docs/BACKEND_API.md`.
+`docs/context/BACKEND-AUDIT.md` §6, §2 and the prior `docs/archive/BACKEND_API.md`.
 
 ### 1.1 Request contract
 
@@ -999,7 +999,7 @@ Example response:
 Exhaustive per-domain, per-endpoint contract for every backend touch-point the
 Angular frontend expects. Derived from source on branch `B2B` and cross-checked
 against `docs/context/BACKEND-AUDIT.md` (the this-session audit — the ground
-truth for what code actually does), the prior `docs/BACKEND_API.md`, and the two
+truth for what code actually does), the prior `docs/archive/BACKEND_API.md`, and the two
 sibling specs written this session:
 
 - **Auth / headers / JWT** — see `docs/AUTHENTICATION.md`. This section never
@@ -4180,7 +4180,7 @@ Frontend view model: `AdminOrder` + `AdminOrderCustomer`, `AdminOrderPayment`,
 Bridge: **a new `AdminOrdersApiGateway` must contain the mapping** JSON → `AdminOrder`, honoring
 the `AdminOrdersGateway` interface methods (`loadOrders`, `loadOrder`, `updateStatus`,
 `requestRefund`, `addNote`, `archiveOrder`, `restoreOrder`, `deleteOrder`). The `status` field
-must respect the order state machine (see the Orders CRUD contract / BACKEND_API.md §8.1).
+must respect the order state machine (see the Orders CRUD contract / archive/BACKEND_API.md §8.1).
 The same "no mapper exists, write one inside the new `*ApiGateway`" note applies to Products,
 Users, Transactions, Monitoring, and Moderation.
 
@@ -4292,14 +4292,14 @@ L on the server.
 
 A literal, top-to-bottom checklist. Work the phases in order; within a phase, items are roughly
 independent. Section references point to the assembled backend-integration document (this doc's
-§8, the CRUD-contracts sections, and `docs/BACKEND_API.md` where a full shape already lives).
+§8, the CRUD-contracts sections, and `docs/archive/BACKEND_API.md` where a full shape already lives).
 
 ### Phase 1 — Foundation (nothing role-gated works until these land)
 
-- [ ] Implement session issuance/check/logout: `POST /users/sessions`, `GET /users/sessions/:id`, `DELETE /users/sessions/:id` — per Auth contract (§5a; BACKEND_API.md `/users/sessions/*`, already client-LIVE).
+- [ ] Implement session issuance/check/logout: `POST /users/sessions`, `GET /users/sessions/:id`, `DELETE /users/sessions/:id` — per Auth contract (§5a; archive/BACKEND_API.md `/users/sessions/*`, already client-LIVE).
 - [ ] Implement the Ed25519 admin-auth flow `GET /api/admin/auth/challenge`, `POST /verify`, `POST /refresh`, `POST /logout` — client wiring is LIVE and 404s today (§5b). Return `AuthChallenge` / `AuthTokenPair` shapes exactly.
 - [ ] Honor the admin auth headers on every gated path: `AdminWebSessionID` + `Authorization: Bearer` for URLs containing `/admin/`, `/backoffice/`, `/builder/`, `/media/` (§3 interceptor pipeline).
-- [ ] Serve real `GET /bootstrap` **content** (branding, theme, navigation, seo — not just the transport) — per Bootstrap contract (§6; BACKEND_API.md §4). This is a P0 blocker.
+- [ ] Serve real `GET /bootstrap` **content** (branding, theme, navigation, seo — not just the transport) — per Bootstrap contract (§6; archive/BACKEND_API.md §4). This is a P0 blocker.
 - [ ] Populate `bootstrap.apiEndpoints.{website,builder,backoffice}` records so tenant-scoped paths resolve at runtime (§6; audit §24 — no path literals exist in client code).
 - [ ] Confirm tenant resolution inputs (host/slug/code) match `TenantConfig` so `ApiConfigService.getBaseUrl()` resolves the right base (§2, §6).
 - [ ] Adopt a consistent error envelope; the client maps failures to a `backend-unavailable` screen for admin auth — keep error bodies non-leaky (§5b; security guidance).
@@ -4309,34 +4309,34 @@ independent. Section references point to the assembled backend-integration docum
 
 - [ ] Stand up `GET /category` returning the `CategoryDto` shape `CategoryMapper` tolerates (§8.4 Example A; audit §8) — already LIVE client-side.
 - [ ] Stand up `GET /items/:id`, `GET /category/:id`, `GET /items/randomitems`, `GET /searchitems` within the `normalizeItem` tolerance envelope (§8.4 Example B; audit §4, §7).
-- [ ] Serve admin categories CRUD via the existing `AdminCategoriesApiGateway` contract: `loadCategories`, `loadCategory`, `create/update/delete/restore`, `isSlugTaken` — per Categories CRUD contract (BACKEND_API.md §6.9). **Already wired client-side (DONE).**
+- [ ] Serve admin categories CRUD via the existing `AdminCategoriesApiGateway` contract: `loadCategories`, `loadCategory`, `create/update/delete/restore`, `isSlugTaken` — per Categories CRUD contract (archive/BACKEND_API.md §6.9). **Already wired client-side (DONE).**
 - [ ] Serve `GET /api/backoffice/products` and `GET /api/backoffice/categories` (storefront cards) — `ApiBackofficeDataProvider` is LIVE (audit §9).
 - [ ] Stand up `GET /regions` → `Region[]` (feeds the `X-Region` header; client falls back to 6 hardcoded regions) (audit §12).
 
 ### Phase 3 — Write-heavy customer domains
 
-- [ ] Keep `POST /cart` (`CartPaymentRequest` → `QrCreateResponse`) and the frozen QR/card payment polling working unchanged (§10; payments frozen per BACKEND_API.md §2.8).
-- [ ] Implement `POST /orders` (`CreateOrderRequest` → `CreateOrderResponse`) — client call is LIVE, fire-and-forget after payment (§10; BACKEND_API.md §16.9, marked DONE client-side).
+- [ ] Keep `POST /cart` (`CartPaymentRequest` → `QrCreateResponse`) and the frozen QR/card payment polling working unchanged (§10; payments frozen per archive/BACKEND_API.md §2.8).
+- [ ] Implement `POST /orders` (`CreateOrderRequest` → `CreateOrderResponse`) — client call is LIVE, fire-and-forget after payment (§10; archive/BACKEND_API.md §16.9, marked DONE client-side).
 - [ ] Implement `POST /purchase-email` (email receipt) (audit §4).
 - [ ] Accept review/question writes `POST /items/:id/callback` and `POST /items/:id/questiion` (**preserve the `questiion` typo** — it matches the client literal) (§11; audit §4).
 
 ### Phase 4 — Admin domains (each needs the token seam added first — §8.5)
 
-- [ ] Add `AdminOrdersGateway` token + `AdminOrdersApiGateway`, switch `AdminOrdersFacade` to the token; implement `GET/POST /backoffice/orders*` incl. `POST /backoffice/orders/:id/status` respecting the order state machine — per Orders CRUD contract (§8.4 Example C, §8.5; BACKEND_API.md §6.11/§8.1).
-- [ ] Add `AdminProductsGateway` token + `AdminProductsApiGateway`, switch `AdminProductsFacade`; implement Products CRUD + variants — per Products CRUD contract (§8.5; BACKEND_API.md §6.10/§7.2).
-- [ ] Add `AdminTransactionsGateway` token + api gateway, switch `AdminTransactionsFacade`; implement transactions list/detail + `retryFailed` + `setFraudFlag` (tied to orders) — per Transactions contract (§8.5; BACKEND_API.md §6.12).
-- [ ] Add `AdminUsersGateway` token + api gateway, switch `AdminUsersFacade`; implement users/roles/invitations/sessions/audit — per Users contract (§8.5; BACKEND_API.md §6.13). Reconcile the duplicate `AdminRole` naming (audit §25 #3).
-- [ ] Add `AdminModerationGateway` token + api gateway, switch `AdminModerationFacade`; implement review + report status transitions — per Moderation contract (§8.5; BACKEND_API.md §6.14/§8.4/§8.5).
-- [ ] Add `AdminMonitoringGateway` token + api gateway, switch `AdminMonitoringFacade`; implement events/queues/webhooks reads — per Monitoring contract (§8.5; BACKEND_API.md §6.16).
-- [ ] Wire `AdminDashboardMetricsApiGateway` to the existing `ADMIN_DASHBOARD_METRICS_GATEWAY` token; implement `loadMetrics` — per Dashboard contract (§8.5; BACKEND_API.md §6.15).
+- [ ] Add `AdminOrdersGateway` token + `AdminOrdersApiGateway`, switch `AdminOrdersFacade` to the token; implement `GET/POST /backoffice/orders*` incl. `POST /backoffice/orders/:id/status` respecting the order state machine — per Orders CRUD contract (§8.4 Example C, §8.5; archive/BACKEND_API.md §6.11/§8.1).
+- [ ] Add `AdminProductsGateway` token + `AdminProductsApiGateway`, switch `AdminProductsFacade`; implement Products CRUD + variants — per Products CRUD contract (§8.5; archive/BACKEND_API.md §6.10/§7.2).
+- [ ] Add `AdminTransactionsGateway` token + api gateway, switch `AdminTransactionsFacade`; implement transactions list/detail + `retryFailed` + `setFraudFlag` (tied to orders) — per Transactions contract (§8.5; archive/BACKEND_API.md §6.12).
+- [ ] Add `AdminUsersGateway` token + api gateway, switch `AdminUsersFacade`; implement users/roles/invitations/sessions/audit — per Users contract (§8.5; archive/BACKEND_API.md §6.13). Reconcile the duplicate `AdminRole` naming (audit §25 #3).
+- [ ] Add `AdminModerationGateway` token + api gateway, switch `AdminModerationFacade`; implement review + report status transitions — per Moderation contract (§8.5; archive/BACKEND_API.md §6.14/§8.4/§8.5).
+- [ ] Add `AdminMonitoringGateway` token + api gateway, switch `AdminMonitoringFacade`; implement events/queues/webhooks reads — per Monitoring contract (§8.5; archive/BACKEND_API.md §6.16).
+- [ ] Wire `AdminDashboardMetricsApiGateway` to the existing `ADMIN_DASHBOARD_METRICS_GATEWAY` token; implement `loadMetrics` — per Dashboard contract (§8.5; archive/BACKEND_API.md §6.15).
 - [ ] Resolve Customers: derive from the real Orders token (`AdminCustomersFacade`) or add a first-class customers source (§8.3).
-- [ ] Defer Analytics until orders/products/moderation are real and a tracking pipeline exists; then implement the analytics summary source (§8.3, §8.6 step 10; BACKEND_API.md §6.17).
+- [ ] Defer Analytics until orders/products/moderation are real and a tracking pipeline exists; then implement the analytics summary source (§8.3, §8.6 step 10; archive/BACKEND_API.md §6.17).
 
 ### Phase 5 — Builder / CMS (net-new write paths — no client call exists today)
 
-- [ ] Implement builder bootstrap draft/publish/validate: `GET/PUT /builder/bootstrap/draft`, `POST /builder/bootstrap/publish`, `POST /builder/bootstrap/validate` — and add the client-side write call in `ProjectEditorFacade`/`ProjectEditorIoService` (§8.3, §17; BACKEND_API.md §6.7). P0 for the builder.
-- [ ] Implement content pages / CMS write path and wire `ContentManagementFacade` beyond in-memory bootstrap (§8.3, §16; BACKEND_API.md §6.8).
-- [ ] Implement the media upload/delete/replace pipeline behind `ApiMediaRepository` bound to the `MediaRepository` token (§8.5; BACKEND_API.md §6.18/§10).
+- [ ] Implement builder bootstrap draft/publish/validate: `GET/PUT /builder/bootstrap/draft`, `POST /builder/bootstrap/publish`, `POST /builder/bootstrap/validate` — and add the client-side write call in `ProjectEditorFacade`/`ProjectEditorIoService` (§8.3, §17; archive/BACKEND_API.md §6.7). P0 for the builder.
+- [ ] Implement content pages / CMS write path and wire `ContentManagementFacade` beyond in-memory bootstrap (§8.3, §16; archive/BACKEND_API.md §6.8).
+- [ ] Implement the media upload/delete/replace pipeline behind `ApiMediaRepository` bound to the `MediaRepository` token (§8.5; archive/BACKEND_API.md §6.18/§10).
 
 ### Phase 6 — Hardening
 
@@ -4345,5 +4345,27 @@ independent. Section references point to the assembled backend-integration docum
 - [ ] Add audit logging for admin mutations (order status, role changes, moderation actions, publish) — the client already models `*AuditEntry` / timeline shapes (audit §23).
 - [ ] Implement maintenance-mode / graceful `backend-unavailable` responses the client can surface (§5b).
 - [ ] Implement `GET /items/batch?ids=` to unblock the user-experience id-only sync redesign (remaining-work #16; §8.3).
-- [ ] Add search suggestions/catalog-filter source if pursuing #15 (§8.6 step 12; BACKEND_API.md §6.6).
+- [ ] Add search suggestions/catalog-filter source if pursuing #15 (§8.6 step 12; archive/BACKEND_API.md §6.6).
 - [ ] Plan dynamic sitemap generation (server-side, no frontend action) (remaining-work #18).
+
+---
+
+## Appendix: `docs/TODO.md` items merged into this document (2026-07-26)
+
+Final Project Closeout moved every backend-shaped item out of `docs/TODO.md` into this
+document. None were duplicated as raw new bullets — each is already covered by an
+existing section above:
+
+| TODO item | Covered by |
+|---|---|
+| `bootstrap.json` real content (branding/theme/nav/seo) | §1 Bootstrap |
+| Builder bootstrap draft/publish/validate | §1 (Draft vs Published), §8, §9 Phase 5 |
+| Backoffice Products CRUD | §3 Products, §8, §9 Phase 4 |
+| Media upload/delete/replace pipeline | §7 Uploads, §9 Phase 5 |
+| Backoffice Orders CRUD + status transitions | §3 Orders, §8, §9 Phase 4 |
+| Backoffice Transactions | §3 Transactions, §9 Phase 4 |
+| Backoffice Users/roles/invitations | §3 Users/Roles, §9 Phase 4 |
+| Backoffice Moderation (reviews/reports) | §3 Reviews/Reports, §9 Phase 4 |
+| Backend Ready sprint / no real API contract | This entire document |
+
+`docs/TODO.md` is now empty of blockers — see that file.