test(mvp1): add owner invariants and media form coverage

TODO.md

@@ -187,14 +187,48 @@ This file is the single source of truth for roadmap and delivery progress.
 ### Testing
 
 - [x] [P1] Unit tests for content schemas and service logic
-- [ ] [P1] Component tests for admin forms (pages/media/navigation)
-- [ ] [P1] Integration tests for owner invariant and hidden support-user protection
+- [~] [P1] Component tests for admin forms (pages/media/navigation)
+- [x] [P1] Integration tests for owner invariant and hidden support-user protection
 - [x] [P1] Integration tests for registration allow/deny behavior
 - [ ] [P1] Integration tests for translated content CRUD and locale-specific validation
 - [~] [P1] E2E happy paths: create page, publish, see on public app
 - [~] [P1] E2E happy paths: media upload + artwork refinement display
 - [~] [P1] E2E happy paths: commissions kanban transitions
 
+### Code Documentation And Handover
+
+- [ ] [P1] Create architecture map per package/app (`what exists`, `why`, `how to extend`) for `@cms/db`, `@cms/content`, `@cms/crud`, `@cms/ui`, `apps/admin`, `apps/web`
+- [ ] [P1] Add module-level ownership docs for auth, media, pages/navigation, commissions, announcements/news flows
+- [ ] [P1] Document critical invariants (single owner rule, protected support user, registration policy gates, media storage key contract)
+- [ ] [P1] Add “request lifecycle” docs for key flows (auth sign-in/up, media upload, page publish, commission status change)
+- [ ] [P1] Add coding handover playbook: local setup, migration workflow, test strategy, branch/release process, common failure recovery
+- [ ] [P2] Add code-level diagrams (Mermaid) for service boundaries and data relationships
+- [ ] [P2] Add route/action inventory for admin and public apps with linked source files
+
+## MVP 1.5: UX/UI And Theming
+
+### MVP1.5 Suggested Branch Order
+
+- [ ] [P1] `todo/mvp15-design-tokens-foundation`:
+  establish shared design tokens (color, spacing, radius, typography scale, motion) in `@cms/ui` and app-level theme contracts
+- [ ] [P1] `todo/mvp15-admin-layout-polish`:
+  refine admin shell, navigation hierarchy, spacing rhythm, table/form visual consistency, empty/loading/error states
+- [ ] [P1] `todo/mvp15-public-layout-and-templates`:
+  define public visual direction (hero/header/footer/content widths), page templates for home/content/news/portfolio
+- [ ] [P2] `todo/mvp15-component-library-pass`:
+  align shadcn-based primitives with CMS brand system (buttons, inputs, cards, badges, tabs, dialogs, toasts)
+- [ ] [P2] `todo/mvp15-responsive-and-a11y-pass`:
+  mobile/tablet breakpoints, keyboard flow, focus states, contrast checks, reduced-motion support
+- [ ] [P2] `todo/mvp15-visual-regression-baseline`:
+  add screenshot baselines for critical admin/public routes to guard layout regressions
+
+### Deliverables
+
+- [ ] [P1] Admin UI baseline feels production-ready for daily editorial use
+- [ ] [P1] Public UI baseline is template-ready for artist branding and portfolio storytelling
+- [ ] [P2] Shared UI primitives are consistent across admin and public apps
+- [ ] [P2] Core routes have visual-regression coverage for the new layout baseline
+
 ## MVP 2: Production Readiness
 
 ### Admin App
@@ -283,6 +317,8 @@ This file is the single source of truth for roadmap and delivery progress.
 - [2026-02-12] Expanded unit coverage for content/domain schemas and post service behavior (`packages/content/src/domain-schemas.test.ts`, `packages/db/src/posts.test.ts`).
 - [2026-02-12] Added auth flow integration tests for `/login`, `/register`, `/welcome` to validate registration allow/deny and owner bootstrap redirects.
 - [2026-02-12] Admin settings now manage public header banner (enabled/message/CTA), backed by `system_setting` and consumed by public layout rendering.
+- [2026-02-12] Added owner/support invariant integration tests for auth guards (`apps/admin/src/lib/auth/server.test.ts`), covering protected-user deletion blocking and one-owner repair/promotion rules.
+- [2026-02-12] Started admin form component tests with media upload behavior coverage (`apps/admin/src/components/media/media-upload-form.test.tsx`).
 
 ## How We Use This File