Initial import with GitLab CI/CD and registry deploy flow

docs/architecture/api-matrix.md

@@ -0,0 +1,91 @@
+# API Matrix by Stage
+
+## Stage 1
+- auth-service: `/auth/login`, `/auth/me`, `/users`
+- audit-service: `/audit/events`
+- all services: `/health`
+
+## Stage 2
+- customer-service: `/customers`
+- interaction-service: `/interactions`
+- routing-service: `/queues`
+- voice-adapter-service: `/integrations/voice/events`
+- telegram-adapter-service: `/integrations/telegram/webhook`
+
+## Stage 3
+- kb-service: `/knowledge/*`
+- reporting-service: `/reports/kpi`, `/reports/export`
+- supervisor-service: `/supervisor/realtime`
+
+## Stage 4
+- recording-service: `/recordings`, `/recordings/*`
+
+## Stage 5
+- ivr-service: `/ivr/flows`, `/ivr/flows/*`, `/ivr/sessions`, `/ivr/sessions/*`
+- routing-service: `/queues/{queue_id}/route` with optional `ivr_session_id`
+
+## Stage 6
+- reporting-service: `/reports/kpi` with optional `channel`
+- reporting-service: `/reports/coverage`
+- reporting-service: `/reports/export` with optional `queue_id` and `channel`
+
+## Stage 7
+- no new business REST routes
+- ops CLI:
+  - `scripts/load_test.py` with profile-driven mixed workload
+  - `scripts/track7_check.py` for scale/hardening evidence validation
+
+## Stage 8
+- no new business REST routes
+- event-bus-service (ops only): `/bus/outbox`, `/bus/outbox/*`
+- ops CLI:
+  - `scripts/event_bus_smoke.py`
+  - `scripts/track8_check.py`
+
+## Stage 9
+- no new business REST routes
+- recording-service: `/recordings/import-upload` (internal bridge upload)
+- asterisk-bridge-service (ops only): `/asterisk/status`, `/asterisk/events`, `/asterisk/events/*`
+- bridge-to-platform auth modes:
+  - `legacy_headers` (QA baseline)
+  - `bearer_first` / `bearer` (Track 9.1 hardening)
+- ops CLI:
+  - `scripts/track9_preflight.py`
+  - `scripts/asterisk_lab_smoke.py`
+  - `scripts/track9_check.py`
+  - `scripts/track9_collect_evidence.py`
+  - `scripts/track9_2_cutover.ps1` (controlled Helm cutover automation)
+
+## Stage 11
+- no new business REST routes
+- asterisk-bridge-service call-control routes:
+  - `/asterisk/live-calls`
+  - `/asterisk/live-calls/{call_id}/claim`
+  - `/asterisk/live-calls/{call_id}/hangup`
+  - `/asterisk/live-calls/{call_id}/blind-transfer`
+  - `/asterisk/live-calls/{call_id}/actions`
+- operator shell uses these routes for live call handling with external softphone media
+
+## Stage 12
+- no new business REST routes
+- additive operator UX route:
+  - `/asterisk/recent-calls`
+- operator shell uses this route for the short-lived recent-calls bucket
+
+## Stage 14
+- no new business REST routes
+- additive browser softphone config route:
+  - `/asterisk/browser-softphone/config`
+- operator shell may use direct browser media over Asterisk WSS in QA
+
+## Stage 15
+- telegram-adapter-service real-bot webhook:
+  - `/integrations/telegram/bot/webhook`
+- telegram-adapter-service operator thread workspace:
+  - `/integrations/telegram/threads`
+  - `/integrations/telegram/threads/{thread_id}`
+  - `/integrations/telegram/threads/{thread_id}/messages`
+  - `/integrations/telegram/threads/{thread_id}/claim`
+  - `/integrations/telegram/threads/{thread_id}/close`
+  - `/integrations/telegram/threads/{thread_id}/escalate`
+- operator shell gets a separate `Telegram` page as the canonical surface for this channel