docs: final project closeout - classify TODO, backend spec, status

Classified every TODO.md item into one of DONE/BACKEND/PRODUCT
DECISION/FUTURE VERSION/BUG, verified against source, not against
prior docs:

- BACKEND items (bootstrap content, builder draft/publish, 6 admin
  CRUD domains, media pipeline) confirmed already covered by
  BACKEND_INTEGRATION.md; appended a mapping appendix rather than
  duplicating raw bullets. Fixed 22 stale internal BACKEND_API.md
  cross-references left over from before that file was archived.
- PRODUCT DECISION items (dark mode, brand-color WCAG contrast,
  stars.component token gap, footer Contacts content, advanced
  analytics, payment providers) moved to new docs/PRODUCT_BACKLOG.md.
- FUTURE VERSION items (Angular 22, bundle splitting, cart-modal
  composition cleanup, hero-spacing investigation) moved to new
  docs/FUTURE_FEATURES.md.
- BUG: rewrote docs/KNOWN-ISSUES.md down to the one real, verified,
  currently-reproducible frontend bug (Ed25519 admin-auth error codes
  session-expired/invalid-signature are unreachable -
  toAuthErrorShape() never reads a body error code, only maps HTTP
  status, and no status ever produces those two codes - confirmed by
  reading auth.service.ts + auth-error.model.ts). Condensed the
  "Fixed" history instead of carrying full verbose repro text forward.
- DONE items removed outright (dead-code deletion, dashboard false
  positive, RC-02 fixes, stale "dynamic-renderer unwired"/"178 missing
  keys" claims already disproven by source).

docs/TODO.md rewritten to the exact "no blockers" template - nothing
left qualifies as a release blocker.

New docs/PROJECT_STATUS.md: honest per-area status (frontend/backend/
docs/auth/builder/storefront/admin), known limitations, and explicit
production/backend/demo readiness calls - including correcting an
initial draft's unpushed-commit count (53, not 10, per git log
origin/B2B..HEAD).

New docs/NEXT_PHASE.md: work that can only start once a real backend
exists (gateway swap-in, mock removal, dormant-auth activation, role
enforcement, integration/E2E tests, perf profiling, monitoring,
maintenance-mode UI).

docs/PROJECT_INDEX.md (the stated entry point) updated to link the new
doc set and stop pointing at the now-archived BACKEND_API.md/AUTH.md.
docs/FRONTEND-ROADMAP.md's "Known open items" replaced with pointers
to the new category-split docs instead of a duplicated mixed list.

Not swept: a handful of low-traffic docs (architecture ADRs,
FRONTEND.md, EDITOR.md, ARCHITECTURE.md, PROJECT-STRUCTURE.md,
StaticPages.md, ADMIN.md) still reference the old BACKEND_API.md/
AUTH.md filenames - noted as a known gap in PROJECT_STATUS.md rather
than touched blindly, since they're historical-context docs, not the
navigation entry point.

docs/PROJECT_INDEX.md

@@ -18,7 +18,7 @@ Every tenant has three surfaces on this one codebase:
 - **Rendering**: Bootstrap JSON → Section Engine → Page Renderer → Widget Host → registered widget component (ADR-005). 100% lazy-loaded routes.
 - **Theming**: CSS custom properties per tenant, 3 theme stylesheets, never hardcoded hex in a component (ADR-008). Design system spec: [`DESIGN.md`](../DESIGN.md) (root of repo).
 - **i18n**: 3 locales (en/ru/hy), compile-time-enforced key parity across locale files.
-- **Backend**: mostly PLANNED (mock gateways behind swappable provider tokens) — see [BACKEND_API.md](BACKEND_API.md) for the full CURRENT/PLANNED/FUTURE endpoint spec, [BACKEND_API_REMAINING_WORK.md](BACKEND_API_REMAINING_WORK.md) for the prioritized punch list. Categories is the one domain fully wired to a real HTTP gateway; everything else is local/mock.
+- **Backend**: mostly PLANNED (mock gateways behind swappable provider tokens) — see [BACKEND_INTEGRATION.md](BACKEND_INTEGRATION.md), the single canonical backend spec (endpoints, DTOs, auth, security, error model, uploads, migration guide, checklist). Categories is the one domain fully wired to a real HTTP gateway; everything else is local/mock.
 
 ## Doc index (living documents)
 
@@ -27,17 +27,22 @@ Read these directly — they're the current source of truth, not one-off reports
 | Doc | What it covers |
 |---|---|
 | [ARCHITECTURE.md](ARCHITECTURE.md) | Layered architecture, container/facade/service pattern, bootstrap/theme/widget engines, links to the enforced ADRs |
-| [BACKEND_API.md](BACKEND_API.md) | Canonical backend/API spec — every endpoint, DTO, state machine, error contract |
-| [BACKEND_API_REMAINING_WORK.md](BACKEND_API_REMAINING_WORK.md) | Prioritized backend punch list (companion to the spec above) |
+| [BACKEND_INTEGRATION.md](BACKEND_INTEGRATION.md) | **Canonical backend spec** — every endpoint, DTO, CRUD contract, auth, security, error model, uploads, migration guide, checklist |
+| [AUTHENTICATION.md](AUTHENTICATION.md) | Standalone auth deep-dive (also inlined in BACKEND_INTEGRATION.md §4) |
+| [ERROR_CONTRACT.md](ERROR_CONTRACT.md) | Standalone error-contract deep-dive (also inlined in BACKEND_INTEGRATION.md §6) |
+| [MAINTENANCE_MODE.md](MAINTENANCE_MODE.md) | Global/tenant/module maintenance-mode contract |
 | [FRONTEND.md](FRONTEND.md) | App structure, routing, i18n, theming, state management, dynamic rendering |
 | [EDITOR.md](EDITOR.md) | The Project Editor: every section, save/publish/draft/reset model |
 | [StaticPages.md](StaticPages.md) | The Static Pages CMS module (the thing that actually serves About/Contacts/etc. today) |
 | [PROJECT-STRUCTURE.md](PROJECT-STRUCTURE.md) | Folder-by-folder tour of `src/app/**` with a worked feature-add example |
 | [ADMIN.md](ADMIN.md) | Admin backoffice: routing, architecture, data sources |
-| [AUTH.md](AUTH.md) | Ed25519 admin auth — prepared, not live; current live gate is Telegram-QR |
+| [PROJECT_STATUS.md](PROJECT_STATUS.md) | **Final Release Candidate status** — frontend/backend/docs/auth/builder/storefront/admin readiness, honest limitations |
 | [FRONTEND-ROADMAP.md](FRONTEND-ROADMAP.md) | Status snapshot refreshed from recent commits — what shipped, what's open |
-| [KNOWN-ISSUES.md](KNOWN-ISSUES.md) | Running list of open/fixed bugs found during manual verification |
-| [TODO.md](TODO.md) | Checklist of everything still remaining, verified against current repo state |
+| [KNOWN-ISSUES.md](KNOWN-ISSUES.md) | Real, reproducible, currently-open frontend bugs only |
+| [PRODUCT_BACKLOG.md](PRODUCT_BACKLOG.md) | Items needing a client/business decision (dark mode, brand colors, page content, etc.) |
+| [FUTURE_FEATURES.md](FUTURE_FEATURES.md) | Nice-to-have, non-blocking future work (Angular 22, bundle splitting, etc.) |
+| [NEXT_PHASE.md](NEXT_PHASE.md) | What happens after backend integration lands |
+| [TODO.md](TODO.md) | Release blockers only — currently empty |
 | [ANGULAR22_PLAN.md](ANGULAR22_PLAN.md) | Angular 22 upgrade feasibility (research only, not yet executed) |
 | [SALES-GUIDE.md](SALES-GUIDE.md) | Plain-language guide for the sales team — what to demo, what's not live yet |
 | [`../DESIGN.md`](../DESIGN.md) | Visual design system: colors, typography, elevation, component specs |
@@ -45,12 +50,13 @@ Read these directly — they're the current source of truth, not one-off reports
 | [`../CHANGELOG.md`](../CHANGELOG.md) | Keep-a-Changelog-format history of shipped features |
 | `docs/architecture/foundation/**` | Enforced ADRs (ADR-001…ADR-010) and standards docs — governance, read directly |
 | `docs/context/**` | Barry Cache's own source-backed memory system — infrastructure, not project documentation, do not edit by hand |
+| `docs/archive/**` | Superseded docs, kept for history only — do not implement against these |
 
-**One topic, one place**: routing lives in FRONTEND.md, not repeated here. Backend contract lives in BACKEND_API.md, not repeated in ADMIN.md. Design tokens live in DESIGN.md, not repeated elsewhere.
+**One topic, one place**: routing lives in FRONTEND.md, not repeated here. Backend contract lives in BACKEND_INTEGRATION.md, not repeated in ADMIN.md. Design tokens live in DESIGN.md, not repeated elsewhere.
 
 ## What's still open
 
-[TODO.md](TODO.md) — checklist of every remaining item across the docs, verified against current repo state.
+[TODO.md](TODO.md) — release blockers only. [PRODUCT_BACKLOG.md](PRODUCT_BACKLOG.md) and [FUTURE_FEATURES.md](FUTURE_FEATURES.md) hold everything else that isn't a blocker.
 
 ## Historical reports
 
@@ -85,4 +91,4 @@ See root `CLAUDE.md` for the full Barry Cache workflow and memory policy.
 - **Documentation**: consolidated (this pass) — 19 one-off reports archived, 2 files renamed for clarity (`PROJECT.md`→`PROJECT_INDEX.md`, `backend/BACKEND-INTEGRATION.md`→`BACKEND_API.md`), 1 duplicate deleted (`RELEASE-NOTES.md` merged into `CHANGELOG.md`).
 - **First client demo**: upcoming — blocked on nothing documentation can fix; see [KNOWN-ISSUES.md](KNOWN-ISSUES.md) for what's still open, starting with the dead-routes finding at the top of this document.
 
-Draft/publish for the Project Editor is still **frontend-only** (localStorage), no backend persistence — the single largest backend gap, see [BACKEND_API.md §6.7](BACKEND_API.md#67-builder--bootstrap-draftpublishvalidate-planned-highest-priority).
+Draft/publish for the Project Editor is still **frontend-only** (localStorage), no backend persistence — the single largest backend gap, see [BACKEND_INTEGRATION.md §1 (Bootstrap: Draft vs Published)](BACKEND_INTEGRATION.md#1-bootstrap) and §8 (Real Backend Implementation Guide).