refactor: remove deploy.cmd and update Dockerfile for health checks

- Deleted the deploy.cmd script as it was no longer needed.
- Updated Dockerfile to include curl for health checks and added a non-root user for improved security.
- Modified health check command to use curl for better reliability.
- Adjusted docker-compose.test.yml to reflect changes in health check configuration.
- Cleaned up appsettings.json and removed unused configuration properties.
- Removed Resource entity and related requests from the codebase as part of the architectural shift.
- Updated documentation to reflect the removal of hardware binding and related endpoints.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_document/tests/blackbox-tests.md

@@ -473,3 +473,349 @@
 
 **Expected outcome**: HTTP 400 with password length validation error
 **Max execution time**: 5s
+
+---
+
+## Cycle 1 Additions (2026-05-13)
+
+The scenarios below were appended during the existing-code cycle 1 Test-Spec Sync (autodev Step 12) for tasks AZ-513, AZ-196, AZ-183, AZ-197. Numbering continues from the legacy IDs above; existing IDs are preserved.
+
+### Cycle 1 Obsoletion Note
+
+The following legacy entries describe behaviour removed by AZ-197 (admin-side hardware-binding cleanup). Their bodies are intentionally left intact to preserve traceability IDs per the cycle-update rule "preserve existing traceability IDs"; they should be treated as obsolete and superseded by FT-N-15 below:
+
+- FT-P-04 (First Hardware Check Stores Fingerprint) — superseded; the `POST /resources/check` endpoint and the hardware-store side-effect were removed.
+- FT-P-05 (Subsequent Hardware Check Matches) — superseded; same endpoint removed.
+- FT-N-06 (Hardware Mismatch) — superseded; the `HardwareIdMismatch` / error code 40 path no longer exists in `ExceptionEnum`.
+- FT-P-09 / FT-P-10 wire shape — the `hardware` field on `POST /resources/get/{dataFolder}` is no longer required; the encryption key is now derived from `email + password` only. The tests still pass without the field; do not regenerate spec bodies until a full `/test-spec` rerun.
+
+See `_docs/03_implementation/batch_06_report.md` for the full AZ-197 implementation rationale and the wire-compat policy decision (drop entirely).
+
+---
+
+### Detection Classes CRUD (AZ-513)
+
+#### FT-P-14: POST /classes Creates Detection Class
+
+**Summary**: ApiAdmin creates a new detection class and the response includes the assigned id.
+**Traces to**: AZ-513 AC-1
+**Category**: Detection Classes CRUD
+
+**Preconditions**:
+- Caller authenticated as ApiAdmin
+- `detection_classes` table exists
+
+**Input data**: `{"name":"Tank","shortName":"T","color":"#FF0000","maxSizeM":5.0}`
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | POST /classes with valid body and ApiAdmin JWT | HTTP 200/201 with body containing assigned `id` and the submitted fields |
+
+**Expected outcome**: HTTP 200 or 201, response body has integer `id` and matches input fields
+**Max execution time**: 5s
+
+---
+
+#### FT-P-15: PATCH /classes/{id} Full Body Update
+
+**Summary**: Updating a detection class with a full body replaces the changed fields.
+**Traces to**: AZ-513 AC-3
+**Category**: Detection Classes CRUD
+
+**Preconditions**:
+- A detection class with id `7` exists with `name: "Tank"`
+
+**Input data**: `{"name":"Heavy Tank","shortName":"T","color":"#FF0000","maxSizeM":5.0}` to PATCH /classes/7
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | PATCH /classes/7 with full body and ApiAdmin JWT | HTTP 200, response body shows `name: "Heavy Tank"` |
+
+**Expected outcome**: HTTP 200, updated entity reflects the changed field
+**Max execution time**: 5s
+
+---
+
+#### FT-P-16: PATCH /classes/{id} Partial Body Update
+
+**Summary**: PATCH with only the changed field updates that field and leaves others intact.
+**Traces to**: AZ-513 AC-4
+**Category**: Detection Classes CRUD
+
+**Preconditions**:
+- A detection class with id `7` exists with `name: "Tank", color: "#FF0000", maxSizeM: 5.0`
+
+**Input data**: `{"color":"#00FF00"}` to PATCH /classes/7
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | PATCH /classes/7 with partial body and ApiAdmin JWT | HTTP 200, response body shows `color: "#00FF00"`; other fields unchanged |
+
+**Expected outcome**: HTTP 200, partial-merge semantics confirmed
+**Max execution time**: 5s
+
+---
+
+#### FT-P-17: DELETE /classes/{id} Removes Class
+
+**Summary**: ApiAdmin deletes a detection class and it disappears from the DB.
+**Traces to**: AZ-513 AC-7
+**Category**: Detection Classes CRUD
+
+**Preconditions**:
+- A detection class with id `7` exists
+
+**Input data**: DELETE /classes/7
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | DELETE /classes/7 with ApiAdmin JWT | HTTP 200 or 204 |
+| 2 | GET the class list (or PATCH the same id) | id 7 no longer present |
+
+**Expected outcome**: HTTP 200/204; class removed from DB
+**Max execution time**: 5s
+
+---
+
+#### FT-N-09: POST /classes Without ApiAdmin JWT
+
+**Summary**: POST /classes requires the same `apiAdminPolicy` as `/users`; non-admin / unauthenticated calls are rejected.
+**Traces to**: AZ-513 AC-2
+**Category**: Detection Classes CRUD
+
+**Preconditions**: None (negative path)
+
+**Input data**: Valid body, but caller has no JWT or a non-ApiAdmin JWT
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | POST /classes without JWT | HTTP 401 |
+| 2 | POST /classes with non-ApiAdmin JWT | HTTP 403 |
+
+**Expected outcome**: HTTP 401 (no JWT) or 403 (non-admin)
+**Max execution time**: 5s
+
+---
+
+#### FT-N-10: PATCH /classes/{id} Unknown id Returns 404
+
+**Summary**: PATCH against a non-existent id returns 404.
+**Traces to**: AZ-513 AC-5
+**Category**: Detection Classes CRUD
+
+**Preconditions**: No detection class with id `9999`
+
+**Input data**: PATCH /classes/9999 with any valid body
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | PATCH /classes/9999 with ApiAdmin JWT | HTTP 404 |
+
+**Expected outcome**: HTTP 404
+**Max execution time**: 5s
+
+---
+
+#### FT-N-11: PATCH /classes/{id} Without ApiAdmin JWT
+
+**Summary**: PATCH /classes/{id} requires `apiAdminPolicy`.
+**Traces to**: AZ-513 AC-6
+**Category**: Detection Classes CRUD
+
+**Input data**: Any valid body to PATCH /classes/{id}
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | PATCH /classes/{id} without JWT | HTTP 401 |
+| 2 | PATCH /classes/{id} with non-ApiAdmin JWT | HTTP 403 |
+
+**Expected outcome**: HTTP 401 or 403
+**Max execution time**: 5s
+
+---
+
+#### FT-N-12: DELETE /classes/{id} Unknown id Returns 404
+
+**Summary**: DELETE against a non-existent id returns 404 (matching `/users` semantics — non-idempotent).
+**Traces to**: AZ-513 AC-8
+**Category**: Detection Classes CRUD
+
+**Preconditions**: No detection class with id `9999`
+
+**Input data**: DELETE /classes/9999
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | DELETE /classes/9999 with ApiAdmin JWT | HTTP 404 |
+
+**Expected outcome**: HTTP 404
+**Max execution time**: 5s
+
+---
+
+#### FT-N-13: DELETE /classes/{id} Without ApiAdmin JWT
+
+**Summary**: DELETE /classes/{id} requires `apiAdminPolicy`.
+**Traces to**: AZ-513 AC-9
+**Category**: Detection Classes CRUD
+
+**Input data**: DELETE /classes/{id}
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | DELETE /classes/{id} without JWT | HTTP 401 |
+| 2 | DELETE /classes/{id} with non-ApiAdmin JWT | HTTP 403 |
+
+**Expected outcome**: HTTP 401 or 403
+**Max execution time**: 5s
+
+---
+
+### Device Auto-Registration (AZ-196)
+
+#### FT-P-18: POST /devices Returns Serial / Email / Password
+
+**Summary**: First call to POST /devices returns the next serial in the `azj-NNNN` sequence with a generated email and 32-char hex password.
+**Traces to**: AZ-196 AC-1
+**Category**: Device Provisioning
+
+**Preconditions**:
+- Caller authenticated as ApiAdmin
+- No (or known-prior) CompanionPC users in DB
+
+**Input data**: POST /devices with no body, ApiAdmin JWT
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | POST /devices with ApiAdmin JWT | HTTP 200 with `serial` matching `^azj-\d{4}$`, `email` = `{serial}@azaion.com`, `password` = 32 lowercase hex chars |
+
+**Expected outcome**: HTTP 200, all three fields shaped per spec
+**Max execution time**: 5s
+
+---
+
+#### FT-P-19: Sequential Device Serials
+
+**Summary**: Repeated calls to POST /devices yield strictly increasing serial numbers.
+**Traces to**: AZ-196 AC-2
+**Category**: Device Provisioning
+
+**Preconditions**:
+- Most recent CompanionPC user has a known serial `azj-NNNN`
+
+**Input data**: POST /devices twice in succession
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | POST /devices → record serial `S1` | HTTP 200 |
+| 2 | POST /devices → record serial `S2` | HTTP 200 |
+| 3 | Parse the numeric suffix of both | numeric(S2) == numeric(S1) + 1 |
+
+**Expected outcome**: HTTP 200, suffix increments by exactly 1
+**Max execution time**: 5s
+
+---
+
+#### FT-P-20: Returned Device Credentials Can Login
+
+**Summary**: The plaintext password returned by POST /devices succeeds against POST /login (and the persisted hash is therefore correct).
+**Traces to**: AZ-196 AC-3, AZ-196 AC-4
+**Category**: Device Provisioning
+
+**Preconditions**:
+- Caller authenticated as ApiAdmin
+
+**Input data**: Use the response from POST /devices as `{Email, Password}` to POST /login
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | POST /devices with ApiAdmin JWT | HTTP 200, `{Serial, Email, Password}` returned |
+| 2 | POST /login with the returned `Email` and `Password` | HTTP 200 with non-empty JWT |
+
+**Expected outcome**: HTTP 200 on login; persisted user has Role=CompanionPC, IsEnabled=true (verified by AdminApi behaviour rather than direct DB inspection)
+**Max execution time**: 5s
+
+---
+
+#### FT-N-14: POST /devices Without ApiAdmin JWT
+
+**Summary**: POST /devices requires `apiAdminPolicy`.
+**Traces to**: AZ-196 AC-5
+**Category**: Device Provisioning
+
+**Input data**: POST /devices
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | POST /devices without JWT | HTTP 401 |
+| 2 | POST /devices with non-ApiAdmin JWT | HTTP 403 |
+
+**Expected outcome**: HTTP 401 or 403
+**Max execution time**: 5s
+
+---
+
+### Resources OTA Update Check (AZ-183) — REVERTED post-cycle-1
+
+The OTA update check & publish feature shipped in cycle 1 was reverted later the same day after the security audit (finding F-1: `/get-update` disclosed plaintext per-resource encryption keys to any authenticated caller). The OTA delivery model itself was deemed obsolete in the target architecture.
+
+The scenarios `FT-P-21`, `FT-P-22`, `FT-P-23` are retained here as ID placeholders so previously-cited references resolve. Their bodies are intentionally collapsed because the underlying endpoints, service, entity, table, and the e2e test class `ResourceUpdateTests.cs` were all removed. See `_docs/02_document/system-flows.md` (Flow F10) and `_docs/05_security/security_report.md` (finding F-1) for context.
+
+| Removed Test ID | Was tracing | Disposition |
+|-----------------|-------------|-------------|
+| FT-P-21 | AZ-183 AC-2 | Removed — endpoint and test deleted |
+| FT-P-22 | AZ-183 AC-3 | Removed — endpoint and test deleted |
+| FT-P-23 | AZ-183 AC-5 | Removed — endpoint and test deleted |
+
+---
+
+### Hardware-Binding Removal (AZ-197)
+
+#### FT-N-15: Hardware Endpoints Removed
+
+**Summary**: The legacy `PUT /users/hardware/set` endpoint and the `POST /resources/check` endpoint have been removed and now return 404.
+**Traces to**: AZ-197 AC-2
+**Category**: Authorization & Routing
+
+**Preconditions**:
+- Updated admin API build (post-AZ-197)
+
+**Input data**: PUT /users/hardware/set and POST /resources/check
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | PUT /users/hardware/set with ApiAdmin JWT | HTTP 404 |
+| 2 | POST /resources/check with ApiAdmin JWT | HTTP 404 |
+
+**Expected outcome**: HTTP 404 on both routes
+**Max execution time**: 5s
+
+Note: AZ-197 AC-1 (resource download works without `Hardware`) is implicitly covered by the existing FT-P-09 / FT-P-10 scenarios once their request bodies are aligned with the new wire shape. AZ-197 AC-3..AC-8 are internal-signature / build-system invariants and are verified at build/CI time, not via a blackbox HTTP scenario.