Stage 10: admin console & dictionary ops (complaint review, hot-reload, broadcasts) (#11)

docs/TESTING.md

@@ -82,6 +82,17 @@ tests or touching CI.
   in `inttest`. Stage 8 adds gateway transcode round-trips for the new social/account
   operations (friends list, friend code issue/redeem, invitation create, stats, GCG,
   the profile-update away round-trip) and a `notify`-event constructor round-trip.
+- **Admin & dictionary ops** *(Stage 10)* — `backend/internal/adminconsole` unit-tests
+  the template renderer over every page plus the embedded asset; `backend/internal/engine`
+  adds the **dictionary hot-reload** cases (`LoadAvailable` loads only the present
+  variants, `OpenWithVersions` scans version subdirectories, a reload registers a new
+  version and moves "latest"); `backend/internal/server` unit-tests the console's
+  **same-origin** CSRF guard; the gateway adds the **verbatim `/_gm` Basic-Auth proxy**
+  (401 / forward, path preserved) and the h2c **console mount** (routed when configured,
+  404 when not). Postgres-backed `inttest` drives the **complaint resolution →
+  dictionary-change pipeline** (file → resolve with a disposition → pending change → mark
+  applied), the admin **list/count** read queries, and the **/_gm console over HTTP**
+  (pages render; a resolve POST needs a same-origin header).
 
 ## Principles