[AZ-512] Cycle 4 Steps 12-15: test-spec sync + docs + sec + perf

Steps 12-15 closure for cycle 4 (AZ-512 admin class inline edit):

- Step 12 (Test-Spec Sync): traceability O9 -> Covered; new FT-P-62
  + FT-N-18 in blackbox-tests.md.
- Step 13 (Update Docs): AdminPage module doc gains the inline-edit
  state slots, four new handlers, PATCH integrations row, expanded
  i18n key list, tests section. architecture.md row 272 now lists
  PATCH /api/admin/classes/{id} with AZ-513 deploy-gate caveat.
- Step 14 (Security Audit): cycle-4 delta report records one new
  LOW finding (F-SAST-CY4-1 lost-update / mid-air-collision on
  PATCH, by design per spec); verdict carries PASS_WITH_WARNINGS;
  bun audit re-run clean.
- Step 15 (Performance Test): NFT-PERF-01 bundle = 291 332 B
  (+757 B / +0.26% vs cycle 3; ~13.89% of 2 MB budget); PASS.

Tests 243 passed / 13 skipped / 0 failed (+12 AZ-512 cases).

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_document/modules/src__features__admin__AdminPage.md

@@ -1,7 +1,8 @@
 # Module: `src/features/admin/AdminPage.tsx`
 
-> **Source**: `src/features/admin/AdminPage.tsx` (209 lines)
+> **Source**: `src/features/admin/AdminPage.tsx`
 > **Topo batch**: B4 (depends on B3: `api/client`, `components/ConfirmDialog`, `types/index`)
+> **Cycle 4 update (2026-05-13, AZ-512)**: gained an inline "edit detection class" affordance — see the new state slots, the `handleStartEdit / handleCancelEdit / handleUpdateClass / handleEditKeyDown` handlers, the PATCH row in the External integrations table, the new i18n keys consumed, and the FT-P-62 / FT-N-18 entries under Tests. Closes Architecture Vision principle **P12** (Objective O9 in `tests/traceability-matrix.md`). Implementation shipped against MSW stubs under the user-authorized Option B path; the live deploy gate remains until AZ-513 ships on the `admin/` workspace.
 
 ## Purpose
 
@@ -37,6 +38,16 @@ No props. Reads everything via `api/client` and local state.
     'Annotator' }`).
   - `deactivateId: string | null` — drives the `ConfirmDialog`'s open
     state for user deactivation.
+  - `editingId: number | null` — id of the detection class currently
+    in inline-edit mode (AZ-512). A single value, not per-row, so
+    opening one row's editor closes any other (AC-2 single-row
+    invariant / Risk 3 mitigation).
+  - `editForm: { name; shortName; color; maxSizeM }` — the inline-edit
+    staging buffer; seeded from the row on edit-start.
+  - `editError: 'nameRequired' | 'maxSizeMustBePositive' | 'updateFailed' | null` —
+    discriminated error kind rendered as an inline `role="alert"`.
+  - `editSaving: boolean` — disables Save + Cancel while the PATCH is
+    in flight (Risk 4 mitigation).
 - **Bootstrap effect** (`useEffect([])` — runs once at mount):
 
   ```ts
@@ -68,6 +79,30 @@ No props. Reads everything via `api/client` and local state.
   ConfirmDialog** despite this being destructive. Inconsistent with
   the user-deactivation flow which uses ConfirmDialog. Flag for Step 4
   against `_docs/ui_design/README.md` confirmation-dialog spec.
+- **`handleStartEdit(c)`** (AZ-512): sets `editingId = c.id`, seeds
+  `editForm` from `c`, clears `editError`. Triggered by the per-row
+  pencil (✎) affordance.
+- **`handleCancelEdit()`** (AZ-512): clears `editingId`, `editError`,
+  `editSaving`. No network call. Also fires on **Escape** inside the
+  form (AC-4).
+- **`handleUpdateClass()`** (AZ-512):
+  1. Guard: `editingId !== null && !editSaving`.
+  2. Validation: `editForm.name.trim()` non-empty (else
+     `setEditError('nameRequired')`); `editForm.maxSizeM > 0` (else
+     `setEditError('maxSizeMustBePositive')`). Both pre-empt the
+     network call (AC-5).
+  3. `setEditSaving(true)`.
+  4. `await api.patch(endpoints.admin.class(editingId), editForm)` —
+     **the complete `editForm` is always sent** (Risk 2 mitigation:
+     the backend's partial-merge vs full-replace semantics become
+     equivalent for the UI).
+  5. On success: `await api.get(endpoints.annotations.classes())`,
+     `setClasses(...)`, `setEditingId(null)`.
+  6. On failure: `setEditError('updateFailed')` — form stays open,
+     edits intact, NO `alert()` (Finding B4 anti-pattern).
+- **`handleEditKeyDown(e)`** (AZ-512): Enter → `handleUpdateClass`;
+  Escape → `handleCancelEdit`. Wired at the container level so any
+  input in the form respects it.
 - **`handleAddUser()`** — analogous to `handleAddClass` against
   `POST endpoints.admin.users()` and `GET endpoints.admin.users()`
   (both → `/api/admin/users`). Guards on `email && password`.
@@ -85,6 +120,11 @@ No props. Reads everything via `api/client` and local state.
   the UI does not).
 - **Layout** (left → center → right, all in one horizontal flex):
   - **Left column** (`w-[340px]`): detection-classes table + add row.
+    Each read-only row carries a pencil (✎) edit button and a `×`
+    delete button (AZ-512). When `c.id === editingId`, that row's
+    cells collapse into a single `colspan=3` form holding name /
+    shortName / color / maxSizeM inputs + Save + Cancel (with an
+    inline `role="alert"` directly below on validation/server error).
   - **Center column** (`flex-1 max-w-md`): AI settings form, GPS
     settings form, users table + add row. The AI and GPS forms have
     `defaultValue` only — there is **no** state, no `Save` handler
@@ -115,10 +155,15 @@ backend assigns `id` and other server-managed fields.
 
 ## Configuration
 
-- **i18n keys consumed**: `admin.classes`, `admin.aiSettings`,
+- **i18n keys consumed**: `admin.classes.title` (was flat
+  `admin.classes` pre-AZ-512), `admin.classes.edit`,
+  `admin.classes.save`, `admin.classes.cancel`,
+  `admin.classes.nameRequired`, `admin.classes.maxSizeMustBePositive`,
+  `admin.classes.updateFailed`, `admin.aiSettings`,
   `admin.gpsSettings`, `admin.users`, `admin.aircrafts`,
   `admin.deactivate`, `common.save`. (Confirmed present in
-  `src/i18n/en.json` admin/common groups.) Plenty of hardcoded
+  `src/i18n/en.json` admin/common groups; ua mirror enforced by the
+  FT-P-22 parity gate.) Plenty of hardcoded
   English strings — placeholders ("Name", "Email", "Password"), table
   headers (`#`, `Name`, `Color`, `Email`, `Role`, `Status`), role
   options (`Annotator`, `Admin`, `Viewer`), the GPS protocol options
@@ -143,6 +188,7 @@ backend assigns `id` and other server-managed fields.
 |---|---|---|
 | `GET` | `endpoints.annotations.classes()` → `/api/annotations/classes` | List detection classes (read path uses annotations service) |
 | `POST` | `endpoints.admin.classes()` → `/api/admin/classes` | Create detection class (write path uses admin service) |
+| `PATCH` | `endpoints.admin.class(id)` → `/api/admin/classes/{id}` | Update detection class (AZ-512 — full body always sent; same URL as DELETE, no new endpoint helper introduced per task constraint) |
 | `DELETE` | `endpoints.admin.class(id)` → `/api/admin/classes/{id}` | Delete detection class |
 | `GET` | `endpoints.flights.aircrafts()` → `/api/flights/aircrafts` | List aircraft |
 | `PATCH` | `endpoints.flights.aircraft(id)` → `/api/flights/aircrafts/{id}` | Toggle `isDefault` |
@@ -175,7 +221,19 @@ Path builders live in `src/api/endpoints.ts` (since AZ-486 / F7). Routed by `ngi
 
 ## Tests
 
-None.
+- `tests/admin_class_edit.test.tsx` (cycle 4, AZ-512) — 12 cases
+  covering AC-1 through AC-6 + AC-8; AC-7 covered by the static
+  FT-P-22 i18n parity gate. Traces to FT-P-62 + FT-N-18 in
+  `_docs/02_document/tests/blackbox-tests.md`.
+- `tests/destructive_ux.test.tsx` (cycle 1) — AZ-466 class-delete
+  destructive-UX `it.fails()` + control pair. Updated cycle 4 to
+  target the `×` delete button by text after the AZ-512 ✎ button
+  was added to the same row's action cell.
+
+No dedicated `AdminPage` happy-path test predates AZ-512; the AC-8
+regression guard in `admin_class_edit.test.tsx` covers Add and
+Delete inline. A broader AdminPage test fixture is a Phase B
+candidate.
 
 ## Notes / open questions