test(10): persist human verification items as UAT

.planning/phases/10-admin-vue-spa/10-UAT.md

@@ -0,0 +1,56 @@
+---
+status: testing
+phase: 10-admin-vue-spa
+source: [10-VERIFICATION.md]
+started: 2026-09-27T16:44:38Z
+updated: 2026-09-27T16:44:38Z
+---
+
+## Current Test
+
+number: 1
+name: Decide CR-01 (refresh ignores tokens_valid_after / is_activated)
+expected: |
+  Secure behavior: after `summer admin:reset-password <login>` and access-token expiry, the SPA lands on the login screen. Current code silently refreshes and keeps working for up to refresh_ttl (14 days). Decide: fix now, or accept with override plus follow-up.
+awaiting: user response
+
+## Tests
+
+### 1. Decide CR-01 (refresh ignores tokens_valid_after / is_activated)
+expected: Fix now or accept with override. Secure behavior is a redirect to login after password reset and token expiry.
+result: [pending]
+
+### 2. Limited admin vs superuser navigation at /plytadmin
+expected: Limited admin (only golem15.fonoteka.access_genres) sees only fonoteka > Genres, no Ustawienia. Superuser sees Albums, Collections, Genres, Styles, Artists plus Ustawienia.
+result: [pending]
+
+### 3. Walkthrough of the five controllers and Ustawienia
+expected: Every list and form renders from its YAML. Search, sort, filter, paging and bulk delete work. Save shows a toast. 422 errors appear under the right fields. Albums genre/artists relations and Ustawienia > search_use_typesense work.
+result: [pending]
+
+### 4. Collection editors link/unlink round trip
+expected: The picker shows 5 per page with the owner excluded. Dodaj (N) is disabled at 0. Linking refreshes the list and shows a plural toast. Unlink asks for confirmation and removes the row. The focus trap and Esc work. The relation manager does not appear on the create form.
+result: [pending]
+
+### 5. Visual check in light/dark at desktop and ~900px
+expected: Matches .planning/phases/10-admin-vue-spa/design. The sidebar stays dark. Below ~1100px the panel collapses to the rail, and the flyout opens on hover/focus, closes on Esc and returns focus.
+result: [pending]
+
+### 6. Secure cookie on http://localhost (assumption A3)
+expected: With backend.cookie_secure at its default, Chrome and Firefox store summer_admin on http://localhost and the session works.
+result: [pending]
+
+### 7. Review the 17 judgment-tier prohibitions in 10-VERIFICATION.md
+expected: Accept or reject the verifier's "not violated" verdicts.
+result: [pending]
+
+## Summary
+
+total: 7
+passed: 0
+issues: 0
+pending: 7
+skipped: 0
+blocked: 0
+
+## Gaps