feat: real API gateways for all remaining local-only domains (F17-F39)

Block 3 of the frontend backlog. 18 gateways were hardcoded to their local
(mock/localStorage) implementation with no seam to a real backend at all -
this closes that gap for everything with a documented contract to build
against.

10 core gateways, token now resolves environment.useMockData ? local : api,
same pattern already proven on fx-quote earlier this session:

  permission, analytics, cart (server-cart), finance, vk-id (identity),
  connector (integrations), marketplace (registry), offer, seller,
  mall-content

8 admin gateways, same pattern:

  orders, products, users, transactions, monitoring, moderation,
  notifications, dashboard-metrics

Endpoints came from the matching contract doc where one exists (Phase 1-10,
Track A, Track S - cited per file). Three domains have no dedicated contract
doc yet (transactions, monitoring, moderation) - those gateways call the
established /api/admin/v2/{resource} convention used throughout the rest of
docs/backend/, flagged in each file's own comment as inferred rather than
specified, for whoever writes that contract to confirm or correct.

One real fix along the way: offer-api.gateway.ts's publish() translates a
422 + details[] response (contract §7's actual failure mode) into the
interface's { ok: false, errors } shape, rather than letting an HTTP error
leak past a caller that expects a value back.

Media repository (mock-media-repository.service.ts) deliberately NOT
swapped - no backend contract exists for it anywhere in docs/backend/, and
inventing endpoint shapes with zero grounding is worse than leaving it mock.

Regression this surfaced, fixed as part of the same change: three spec files
stubbed a gateway's concrete Local class directly via useValue. That worked
by accident while the token unconditionally resolved to the local class; once
the token became conditional on useMockData, those specs silently injected
the real (unmocked) API gateway instead and failed. Fixed by providing the
token instead of the class - the pattern the ADMIN_CATEGORIES_GATEWAY entry
in the same spec file already used correctly, because categories was
already token-swapped before this session:
  - admin-analytics.facade.spec.ts (orders/products/moderation gateways)
  - admin-order-watcher.service.spec.ts (orders gateway, 3 call sites)

Verified: 115/115 unit tests, 5/5 E2E, arch:check clean, production build
succeeds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/app/features/admin/notifications/services/admin-notifications-api.gateway.ts

@@ -0,0 +1,37 @@
+import { HttpClient, HttpParams } from '@angular/common/http';
+import { Injectable, inject } from '@angular/core';
+import { Observable } from 'rxjs';
+import { map } from 'rxjs/operators';
+import { AdminNotification, AdminNotificationFilters } from '../models/admin-notification.model';
+import { AdminNotificationsGateway } from './admin-notifications-gateway.interface';
+
+/** Contract: docs/backend/PHASE-2-ORDERS-NOTIFICATIONS-CONTRACT.md §7. */
+@Injectable({ providedIn: 'root' })
+export class AdminNotificationsApiGateway implements AdminNotificationsGateway {
+  private readonly http = inject(HttpClient);
+
+  loadNotifications(filters: AdminNotificationFilters): Observable<AdminNotification[]> {
+    let params = new HttpParams();
+    for (const [key, value] of Object.entries(filters ?? {})) {
+      if (value !== undefined && value !== null && value !== '') {
+        params = params.set(key, String(value));
+      }
+    }
+    return this.http.get<AdminNotification[]>('/api/admin/v2/notifications', { params });
+  }
+
+  markRead(id: string): Observable<void> {
+    return this.http
+      .patch(`/api/admin/v2/notifications/${encodeURIComponent(id)}/read`, {})
+      .pipe(map(() => undefined));
+  }
+
+  markAllRead(): Observable<void> {
+    // Contract documents per-notification PATCH .../{id}/read only; a bulk
+    // endpoint isn't specified. Inferred at the collection path pending that
+    // being defined - revisit if the backend does this differently.
+    return this.http
+      .patch('/api/admin/v2/notifications/read-all', {})
+      .pipe(map(() => undefined));
+  }
+}

src/app/features/admin/notifications/services/admin-notifications-gateway.token.ts

@@ -1,9 +1,11 @@
 import { InjectionToken, inject } from '@angular/core';
+import { environment } from '../../../../../environments/environment';
 import { AdminNotificationsGateway } from './admin-notifications-gateway.interface';
 import { AdminNotificationsLocalGateway } from './admin-notifications-local.gateway';
+import { AdminNotificationsApiGateway } from './admin-notifications-api.gateway';
 
-/** Swap point for docs/backend/PHASE-2-ORDERS-NOTIFICATIONS-CONTRACT.md §6. */
+/** Swap point for docs/backend/PHASE-2-ORDERS-NOTIFICATIONS-CONTRACT.md §7. */
 export const ADMIN_NOTIFICATIONS_GATEWAY = new InjectionToken<AdminNotificationsGateway>('ADMIN_NOTIFICATIONS_GATEWAY', {
   providedIn: 'root',
-  factory: () => inject(AdminNotificationsLocalGateway),
+  factory: () => (environment.useMockData ? inject(AdminNotificationsLocalGateway) : inject(AdminNotificationsApiGateway)),
 });