Milestone 2: module/model docs (MD, Sphinx RST, PDF) and work log

74 source modules documented with extracted signatures, JSDoc params,
imports, and call graphs. 10 first-class models (PriceRule through
StatusResponse) have their own MD/RST/PDF. Sphinx HTML builds from
docs/sphinx. Per-module PDFs in docs/modules-pdf and docs/models-pdf.

Middleware gates 2–6 and 10 pass on MOCK_VERAE without NATS.

Learned: RST includes are relative to the RST file; keep one PDF per
module; Add Numbers remains the only push required tomorrow.

docs/modules/zappier/admin.md

@@ -0,0 +1,73 @@
+# `zappier/admin`
+
+**Package:** `zappier`  
+**Source:** `packages/zappier/src/admin.ts`  
+**Lines:** 486
+
+## What this module is
+
+Implementation module in `zappier`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`adminLoginRouter`, `adminAuth`, `AccountingDeps`, `renderInvoiceHtml`, `adminRouter`
+
+## Types / interfaces / classes
+
+| Kind | Name |
+|------|------|
+| interface | `AccountingDeps` |
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `adminLoginRouter` | `users: AdminUserRepo` | — | `unknown` | see Call graph |
+| `adminAuth` | `(none)` | — | `unknown` | see Call graph |
+| `isValidRule` | `rule: unknown` | — | `unknown` | see Call graph |
+| `isValidTier` | `tier: unknown` | — | `unknown` | see Call graph |
+| `periodWindow` | `period: string` | — | `unknown` | see Call graph |
+| `parseDate` | `value: unknown` | — | `unknown` | see Call graph |
+| `escapeHtml` | `s: string` | — | `unknown` | see Call graph |
+| `renderInvoiceHtml` | `invoice: Invoice, customerName: string` | — | `unknown` | see Call graph |
+| `adminRouter` | `store: PricingStore,
+  customers: CustomerRepo,
+  accounting: AccountingDeps,` | — | `unknown` | see Call graph |
+
+## Methods (class / object)
+
+| Name | Parameters |
+|------|------------|
+| `return` | `req, res, next` |
+| `return` | `typeof t.name === 'string' &&
+    typeof t.multiplier === 'number' &&
+    typeof t.monthlyCreditCents === 'number' &&
+    (t.defaultRule === undefined || isValidRule(t.defaultRule` |
+
+## What it imports / requires
+
+- `crypto`
+- `fs`
+- `path`
+- `express`
+- `./accounts`
+- `./admin-users`
+- `./auth`
+- `./invoicing`
+- `./pricing`
+- `./paths`
+- `./reports`
+- `./usage`
+
+## Call graph (identifiers invoked)
+
+`tokens`, `adminLoginRouter`, `post`, `status`, `json`, `findByUsername`, `verifyPassword`, `randomBytes`, `toString`, `set`, `now`, `adminAuth`, `header`, `next`, `startsWith`, `slice`, `has`, `isValidRule`, `every`, `isValidTier`, `periodWindow`, `split`, `map`, `parseDate`, `trim`, `isNaN`, `getTime`, `escapeHtml`, `replace`, `toFixed`, `renderInvoiceHtml`, `dollars`, `join`, `toISOString`, `toUpperCase`, `adminRouter`, `get`, `getRateCard`, `getTiers`, `put`, `upsertEndpoint`, `delete`, `deleteEndpoint`, `upsertTier`, `deleteTier`, `list`, `randomUUID`, `save`, `find`, `test`, `push`, `listFor`, `filter`, `buildInvoice`, `nextSequence`, `type`, `send`, `untouched`, `flatMap`, `billingRows`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+