[AZ-460] [AZ-462] [AZ-466] [AZ-475] Batch 4 - destructive UX/forms/overlay/save

AZ-466 — Destructive UX policy + ConfirmDialog a11y + no-alert (4pts):
  src/components/ConfirmDialog.test.tsx (8 fast),
  tests/destructive_ux.test.tsx (4 fast, AdminPage class-delete drift),
  e2e/tests/destructive_ux.e2e.ts. New static checks STC-SEC7 (alert
  allowlist) + STC-SEC8 (destructive-surfaces gated/drift) wired through
  scripts/check-banned-deps.mjs reading tests/security/banned-deps.json.

AZ-475 — Numeric form input rejection (2pts):
  tests/form_hygiene.test.tsx (3 fast). Documents two SettingsPage drifts:
  silent zero coercion via parseInt(v)||0 and labels missing htmlFor.

AZ-462 — Overlay membership at in-window edges (2pts):
  tests/overlay_membership.test.tsx (6 fast). Documents getTimeWindowDetections
  strict < drift; AC-1 boundary tests are it.fails(); AC-2 / control PASS.
  Mocks HTMLCanvasElement.getContext to capture strokeRect.

AZ-460 — Annotation save URL + payload contract (2pts):
  tests/annotations_endpoint.test.tsx (6 fast),
  e2e/tests/annotations_endpoint.e2e.ts. AC-1 URL canary PASSes; AC-2
  payload missing 4 fields documented as it.fails(); AC-3 manual-draw
  PASS, AI-suggestion-accept + bulk-edit-save QUARANTINE skip.

Test infrastructure:
  - tests/setup.ts: NoopResizeObserver + NoopEventSource JSDOM polyfills.
  - tests/msw/handlers/annotations.ts: doubly-prefixed paths matching
    production calls (e.g. /api/annotations/annotations).
  - tests/msw/handlers/flights.ts: plural /aircrafts paths.

Verification: bun run test:fast → 80 passed, 13 skipped (14 files).
scripts/run-tests.sh --static-only → 24/24 PASS (was 22; +STC-SEC7/SEC8).
Per-batch self-review verdict: PASS_WITH_WARNINGS. Cumulative review
of batches 04-06 due after batch 6 per implement/SKILL.md Step 14.5.
Report: _docs/03_implementation/batch_04_report.md.

Also includes the previously-untracked
_docs/03_implementation/cumulative_review_batches_01-03_report.md
generated at the start of this session before batch 4 began.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/msw/handlers/annotations.ts

@@ -27,18 +27,41 @@ export const annotationsHandlers = [
     jsonResponse(seedAnnotations.filter((a) => a.mediaId === params.id)),
   ),
 
-  http.get('/api/annotations', () => jsonResponse(seedAnnotations)),
+  // Production routes use the doubly-prefixed canary `/api/annotations/annotations/*`
+  // — gateway prefix `/api/annotations/` + service base `/annotations/`. AZ-460 AC-1
+  // pins this path; the static check would catch a single-prefix regression.
+  http.get('/api/annotations/annotations', ({ request }) => {
+    const url = new URL(request.url)
+    const mediaId = url.searchParams.get('mediaId')
+    const items = mediaId ? seedAnnotations.filter((a) => a.mediaId === mediaId) : seedAnnotations
+    const page = Number(url.searchParams.get('page') ?? '1')
+    const pageSize = Number(url.searchParams.get('pageSize') ?? String(items.length))
+    return jsonResponse(paginate(items, page, pageSize))
+  }),
 
-  http.post('/api/annotations', async ({ request }) => {
+  http.post('/api/annotations/annotations', async ({ request }) => {
     const body = (await request.json()) as Record<string, unknown>
     return jsonResponse({ id: 'ann-new', createdDate: new Date().toISOString(), ...body }, { status: 201 })
   }),
 
-  http.patch('/api/annotations/:id/status', async ({ request, params }) => {
+  http.patch('/api/annotations/annotations/:id/status', async ({ request, params }) => {
     const body = (await request.json()) as { status?: number }
     return jsonResponse({ id: params.id, status: body.status ?? 10 })
   }),
 
+  http.delete('/api/annotations/annotations/:id', () => noContent()),
+
+  // Single-prefix variants kept for backward compatibility with existing tests
+  // that may rely on them. Production uses doubly-prefixed (above).
+  http.get('/api/annotations', () => jsonResponse(seedAnnotations)),
+  http.post('/api/annotations', async ({ request }) => {
+    const body = (await request.json()) as Record<string, unknown>
+    return jsonResponse({ id: 'ann-new', createdDate: new Date().toISOString(), ...body }, { status: 201 })
+  }),
+  http.patch('/api/annotations/:id/status', async ({ request, params }) => {
+    const body = (await request.json()) as { status?: number }
+    return jsonResponse({ id: params.id, status: body.status ?? 10 })
+  }),
   http.delete('/api/annotations/:id', () => noContent()),
 
   http.get('/api/annotations/dataset', () =>
@@ -87,4 +110,41 @@ export const annotationsHandlers = [
     const body = (await request.json()) as Record<string, unknown>
     return jsonResponse({ id: 'user-settings-1', userId: params.userId, ...body })
   }),
+
+  // System / directory settings — used by `<SettingsPage>` (production paths).
+  http.get('/api/annotations/settings/system', () =>
+    jsonResponse({
+      id: 'sys-settings-1',
+      name: 'Test System',
+      militaryUnit: null,
+      defaultCameraWidth: 1920,
+      defaultCameraFoV: 60,
+    }),
+  ),
+  http.put('/api/annotations/settings/system', async ({ request }) =>
+    jsonResponse(await request.json()),
+  ),
+  http.get('/api/annotations/settings/directories', () =>
+    jsonResponse({
+      id: 'dirs-1',
+      videosDir: '/srv/videos',
+      imagesDir: '/srv/images',
+      labelsDir: '/srv/labels',
+      resultsDir: '/srv/results',
+      thumbnailsDir: '/srv/thumbs',
+      gpsSatDir: '/srv/gps-sat',
+      gpsRouteDir: '/srv/gps-route',
+    }),
+  ),
+  http.put('/api/annotations/settings/directories', async ({ request }) =>
+    jsonResponse(await request.json()),
+  ),
+
+  // Used by AdminPage when listing detection classes for the editor.
+  http.get('/api/annotations/classes', () =>
+    jsonResponse([
+      { id: 1, name: 'class-a', shortName: 'a', color: '#ff0000', maxSizeM: 7 },
+      { id: 2, name: 'class-b', shortName: 'b', color: '#00ff00', maxSizeM: 5 },
+    ]),
+  ),
 ]

tests/msw/handlers/flights.ts

@@ -54,8 +54,16 @@ export const flightsHandlers = [
     ]),
   ),
 
+  // Production uses the plural path `/api/flights/aircrafts`. Singular alias kept
+  // for any future test that follows REST-singular conventions; production paths win.
+  http.get('/api/flights/aircrafts', () => jsonResponse(seedAircraft)),
   http.get('/api/flights/aircraft', () => jsonResponse(seedAircraft)),
 
+  http.patch('/api/flights/aircrafts/:id', async ({ request, params }) => {
+    const body = (await request.json()) as Record<string, unknown>
+    return jsonResponse({ id: params.id, ...body })
+  }),
+
   http.post('/api/flights/aircraft', async ({ request }) => {
     const body = (await request.json()) as Record<string, unknown>
     return jsonResponse({ id: 'aircraft-new', ...body }, { status: 201 })