[AZ-447] autodev Steps 1-4 baseline: docs, tests, refactor specs

Captures the full output of autodev existing-code Phase A through
Step 4 (Code Testability Revision) for the Azaion UI workspace:

- Step 1 Document: _docs/02_document/ (FINAL_report, architecture,
  glossary, components/, modules/, diagrams/, system-flows,
  module-layout) plus _docs/00_problem/ + _docs/01_solution/ +
  _docs/legacy/ + _docs/how_to_test + README.
- Step 2 Architecture Baseline: architecture_compliance_baseline.md.
- Step 3 Test Spec: _docs/02_document/tests/ (environment,
  test-data, blackbox/performance/resilience/security/
  resource-limit tests, traceability-matrix), enum_spec_snapshot,
  expected_results/results_report.md (98 rows), plus the
  run-tests.sh + run-performance-tests.sh runners.
- Step 4 Code Testability Revision: 01-testability-refactoring/
  run dir (list-of-changes C01-C07, deferred_to_refactor,
  analysis/research_findings + refactoring_roadmap) and the 7
  child task specs AZ-448..AZ-454 under _docs/02_tasks/todo/
  plus _dependencies_table.md.
- _docs/_autodev_state.md pins the cursor at Step 4 / refactor
  Phase 4 entry so /autodev resumes cleanly.

Epic AZ-447 (UI testability gates) tracks the 7 child tasks that
will land in subsequent commits.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_document/components/08_admin/description.md

@@ -0,0 +1,64 @@
+# 08 — Admin
+
+## 1. High-Level Overview
+
+**Purpose**: Operator-only configuration page. User management, detection-class management, AI Settings, GPS Settings, aircraft default.
+
+**Architectural Pattern**: Single-page feature, large monolithic component (~215 lines pre-consolidation per state.json).
+
+**Upstream dependencies**: `00_foundation`, `01_api-transport`, `03_shared-ui` (ConfirmDialog).
+
+**Downstream consumers**: `10_app-shell` (routed at `/admin`, **currently with no role-based guard** — see #1 caveat below).
+
+## 2. Internal Interfaces
+
+| Export | Notes |
+|--------|-------|
+| `AdminPage()` | Top-level route component. Sub-sections: Users, Detection Classes, AI Settings, GPS Settings, Aircraft default. |
+
+## 3. External API Specification
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| GET / POST / PUT / DELETE | `/api/admin/users` | User CRUD |
+| GET | `/api/annotations/classes` | Read class list (note: read uses `annotations/`, write uses `admin/`) |
+| POST / PUT / DELETE | `/api/admin/classes` | Class CRUD |
+| GET / PUT | `/api/admin/settings/ai` | AI service config |
+| GET / PUT | `/api/admin/settings/gps` | GPS device config |
+| GET / PUT | `/api/admin/settings/aircraft-default` | Aircraft default |
+
+## 5. Implementation Details
+
+**State Management**: Page-local React state per sub-form. No global form library.
+
+**Findings (B4, copied from state.json):**
+
+1. **PRIORITY (security): no role-based route guard on `/admin`** — anyone authenticated can access. Server-enforced 403 protects the data, but UI does not gate. Surface in Step 6 problem-extraction. Cross-link with `10_app-shell`.
+2. **AI Settings & GPS Settings forms render with `defaultValue` only — NO state, NO submit handler, the Save button does nothing.** PRIORITY surface in Step 6.
+3. **Hardcoded GPS device default `'192.168.1.100'` / port `'5535'`** shipped in production bundle. Step 4.
+4. **`handleDeleteClass` has NO `ConfirmDialog`** despite being destructive. Step 4 vs `ui_design/README.md`.
+5. **Service split mismatch**: detection-class read uses `/api/annotations/classes` (annotations service) but write uses `/api/admin/classes` (admin service). Verify with suite ADRs in Step 3a.
+6. **`handleToggleDefault` duplicated** between AdminPage and SettingsPage; aircraft default is global config but page exists in both `/admin` and `/settings` — surface intent in Step 6.
+7. **Many hardcoded English strings.** Step 4 i18n.
+
+**Key Dependencies**: `03_shared-ui/ConfirmDialog` (used for some destructive actions; missing on `handleDeleteClass`).
+
+## 7. Caveats & Edge Cases
+
+- The **broken Save button** is the most user-visible bug.
+- The **annotations/admin service split** for class CRUD looks like a copy-paste residue but may be deliberate; verify in Step 3a.
+- **No optimistic concurrency / version check** for any settings — last writer wins.
+
+## 8. Dependency Graph
+
+**Must be implemented after**: `00_foundation`, `01_api-transport`, `03_shared-ui`.
+
+**Can be implemented in parallel with**: every other feature page.
+
+**Blocks**: `10_app-shell`.
+
+## Module Inventory
+
+| Path | Module Doc |
+|------|------------|
+| `src/features/admin/AdminPage.tsx` | `_docs/02_document/modules/src__features__admin__AdminPage.md` |