docs: add project documentation and initial specs

specs/admin.md

@@ -0,0 +1,48 @@
+# Admin Feature Spec
+
+## Current Implementation
+
+### Access model
+
+- Middleware can protect admin routes with Basic Auth
+- App login requires configured password and signed cookie session
+- Failed password attempts trigger lockout
+
+### Routing
+
+- Source pages live in
+
+`app/_admin`
+
+- Middleware rewrites to
+
+`app/admin-internal`
+
+- Development compatibility routes exist under
+
+`app/root`
+
+### Capabilities
+
+- Overview dashboard
+- Maintenance mode
+- Media Library
+- Site Settings
+- Marquee Settings
+- SMTP Settings
+- Contact Protection
+- Portfolio categories
+- Portfolio projects
+- UI Kit page
+
+## Constraints
+
+- Admin currently assumes a single shared operator credential model
+- No role-based access control exists
+- No audit log exists
+
+## Recommended Improvements
+
+- Add per-user authentication if multiple operators are expected
+- Add action audit logging for content and configuration changes
+- Add tests around middleware rewriting and auth edge cases