[AZ-485] [AZ-486] Cycle 1 docs refresh (Step 13)

Phase B cycle 1 was a structural refactor only: F4 (barrel imports +
STC-ARCH-01) and F7 (endpoint builders + STC-ARCH-02). This commit
brings docs in line with source after the cycle, no code changes.

Module docs (12 consumers): swap every /api/<service>/... literal in
code snippets and integration tables for the matching endpoints.*
builder; note the barrel import migration in Dependencies.

New module doc: src__api__endpoints.md (public surface, F4 barrel
re-export note, STC-ARCH-02 enforcement, contract-test reference).

Architecture compliance baseline: mark F4 + F7 CLOSED with commit
hashes (23746ec, 8a461a2).

01_api-transport component description: add endpoints.ts + barrel to
Internal Interfaces, close the F7 caveat, extend Module Inventory.

ripple_log_cycle1.md: Task Step 0.5 reverse-dep analysis records the
import-graph closure (no extra docs needed beyond the direct set).

Carry-over reports landed alongside the docs:
- test_run_report_phase_b_cycle1.md (Step 11 outcome)
- implementation_report_refactor_phase_b_cycle1.md (cycle summary)

State file: trimmed to the autodev <30-line target; Steps 14 + 15
recorded as SKIPPED with rationale (no security or perf surface
changed in this cycle); pointer moved to Step 16 (Deploy).

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_document/components/01_api-transport/description.md

@@ -28,6 +28,16 @@
 |--------|-----------|-------|
 | `subscribe<T>(url, onMessage, onError?): { close }` | factory | Creates `EventSource` with the **bearer token in the query string** (browser `EventSource` can't set headers). Returns a `close()` handle. |
 
+### `src/api/endpoints.ts` (since AZ-486 / F7)
+
+| Export | Signature | Notes |
+|--------|-----------|-------|
+| `endpoints` | `Readonly<{ admin, annotations, flights, detect }>` of typed builder functions | Single source of truth for every `/api/<service>/...` URL the UI talks to. Each leaf is a function — `() => string` for constant paths, `(id, ...) => string` for parameterised ones. Wire-contract pinned by `src/api/endpoints.test.ts` (36 assertions). |
+
+### `src/api/index.ts` (Public API barrel, since AZ-485 / F4)
+
+Re-exports the component's public surface: `api`, `createSSE`, `setToken`, `getToken`, `getApiBase`, `setNavigateToLogin`, `endpoints`. Consumers OUTSIDE this component MUST import from the barrel; direct imports of `src/api/{client,sse,endpoints}` from other components are blocked by `STC-ARCH-01`.
+
 ## 3. External API Specification
 
 This component does not *expose* an API; it consumes the suite's. The set of consumed endpoints (collected from feature module docs):
@@ -40,7 +50,7 @@ This component does not *expose* an API; it consumes the suite's. The set of con
 | `detect/` | `/api/detect/...` | `06_annotations` |
 | `loader/`, `resource/`, `gps-denied-*`, `autopilot/` | `/api/{loader,resource,gps-denied-desktop,gps-denied-onboard,autopilot}/...` | various features |
 
-**No service-specific client modules exist**. URL strings are inlined at every call site (testability finding from autodev Step 4).
+**No service-specific client modules exist**. URL strings are produced by typed builders in `src/api/endpoints.ts` (added by AZ-486 / F7, commit `8a461a2`) — the previous "URL strings inlined at every call site" testability finding (F7) is **CLOSED**. The `STC-ARCH-02` static gate (`scripts/check-arch-imports.mjs --mode=api-literals`, wired into `scripts/run-tests.sh`) forbids re-introducing `/api/<service>/...` literals under `src/`.
 
 ## 5. Implementation Details
 
@@ -60,7 +70,7 @@ This component does not *expose* an API; it consumes the suite's. The set of con
 - **No timeout / cancellation**. (Step 4.)
 - **Bearer in SSE query string**. Accepted trade-off; document in `security_approach.md` (Step 6).
 - **No reconnect-on-token-rotate** for SSE consumers — every feature that uses SSE will silently stop receiving events after the first refresh (Step 8 hardening).
-- **No service-specific clients** → URL strings duplicated across features. Risk of typos surfacing as 404s only at runtime (Step 4).
+- ~~No service-specific clients~~ → **CLOSED by AZ-486 / F7**: URL strings centralised in `src/api/endpoints.ts`; STC-ARCH-02 enforces it. Typos now surface at build time (TS strict on the builder names) or in `endpoints.test.ts`, never at runtime.
 
 ## 8. Dependency Graph
 
@@ -76,3 +86,5 @@ This component does not *expose* an API; it consumes the suite's. The set of con
 |------|------------|
 | `src/api/client.ts` | `_docs/02_document/modules/src__api__client.md` |
 | `src/api/sse.ts` | `_docs/02_document/modules/src__api__sse.md` |
+| `src/api/endpoints.ts` | `_docs/02_document/modules/src__api__endpoints.md` |
+| `src/api/index.ts` (barrel) | (no separate doc — re-exports surface listed in §2 above) |