Three plans per D-22: server side, SPA support (D-21), tests. D-12 amended: a password set for another admin keeps their personal API tokens, as admin:reset-password does. Research open questions marked resolved.