Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/httpapi/admin_dev_impersonation_test.go

@@ -0,0 +1,32 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestRouterProductionOmitsImpersonationRoutes(t *testing.T) {
+	t.Parallel()
+	s := testAPIServer()
+	s.Config.AppEnv = "production"
+	h := s.Router()
+
+	for _, path := range []string{
+		"/api/admin/users/00000000-0000-0000-0000-000000000001/impersonate",
+		"/api/admin/dev/stop-impersonate",
+		"/api/admin/dev/switchable-users",
+	} {
+		rec := httptest.NewRecorder()
+		method := http.MethodPost
+		if path == "/api/admin/dev/switchable-users" {
+			method = http.MethodGet
+		}
+		h.ServeHTTP(rec, httptest.NewRequest(method, path, nil))
+		// Unauthenticated session yields 401; production must not expose the route as 200/403 from the handler.
+		// Mounted routes behind RequireSession return 401; unmounted chi paths under /api/admin still hit RequireSession then 404 for unknown — either way not a successful switch.
+		if rec.Code == http.StatusOK {
+			t.Fatalf("%s returned 200 in production", path)
+		}
+	}
+}