Defer Phase 6 (User Story 4) for POC - Manual YAML management

Updated specifications to reflect that User Story 4 (Product/Service
Registration and Management) is out of scope for the proof-of-concept.
Admin UI for product/user management is deferred in favor of manual
YAML file editing.

Specification Updates:

spec.md:
- Marked User Story 4 as [DEFERRED FOR POC]
- Added rationale: Manual management sufficient for POC
- Added manual management approach documentation
- Preserved original requirements (strikethrough) for future reference
- Updated FR-045 to FR-054 to indicate DEFERRED or IMPLEMENTED status
- Clarified which features work via YAML vs need admin UI

plan.md:
- Added POC Scope Update note in Summary section
- Documented that User Stories 1-3 are IMPLEMENTED
- Explained User Story 4 deferral and manual management approach
- Preserved original plan structure for future reference

tasks.md:
- Marked Phase 6 header as [DEFERRED FOR POC]
- Added comprehensive rationale and manual management guide
- Documented what's already implemented (models, access control)
- Listed manual operations: create product, edit product, create user, etc.
- Clarified that underlying features work, only admin UI is deferred
- Preserved all T140-T192 tasks for future implementation
- Added "Future Consideration" note

Rationale:
For a proof-of-concept, the admin UI adds no validation value. The core
functionality (anonymous submission, AI analysis, dashboard access) is
fully implemented and testable. Products and users can be managed via
YAML files:
- Products: data/products/{id}/config.yaml
- Users: data/users.yaml (with bcrypt passwords)

What Works Without Admin UI:
✅ Multi-product support (Product model + access control)
✅ Product owner assignment (via users.yaml product_ids field)
✅ Unique submission URLs per product (submission_url_slug)
✅ Archived product blocking (checked in submission route)
✅ Role-based access (owners see assigned, admins see all)

Decision Benefits:
- Reduces POC scope to essential features
- Eliminates ~53 admin UI tasks (T140-T192)
- Maintains all core product/user functionality
- Enables faster POC validation
- Can be implemented later if scaling is needed

Next Steps:
Focus on Phase 7 (Polish) - production hardening, documentation,
performance verification, and deployment readiness.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

specs/001-build-an-application/tasks.md

@@ -228,13 +228,32 @@
 
 ---
 
-## Phase 6: User Story 4 - Product/Service Registration and Management (Priority: P4)
+## Phase 6: User Story 4 - Product/Service Registration and Management ~~(Priority: P4)~~ **[DEFERRED FOR POC]**
 
-**Goal**: Enable administrators to register products, assign owners, manage product settings, and view statistics
+**Status**: **OUT OF SCOPE FOR POC** - Products and users managed manually via YAML files
 
-**Independent Test**: Login as admin, create new product with name/language/owners, verify submission URL works, assign additional owners, archive product, verify submissions blocked
+**Rationale**: For a proof-of-concept, manual management of products and users through configuration files is sufficient. Building an admin UI for product/user management does not add value at this stage. The underlying product/user models and access control are already implemented - only the admin UI routes are deferred.
 
-### Tests for User Story 4 (MUST WRITE FIRST) ⚠️
+**Manual Management Guide**:
+- **Create Product**: Create `data/products/{product-id}/` directory with `config.yaml`
+- **Edit Product**: Modify `data/products/{product-id}/config.yaml` (fields: product_id, name, submission_url_slug, owner_language, assigned_owner_ids, status)
+- **Create User**: Add entry to `data/users.yaml` with bcrypt-hashed password
+- **Assign Product Owners**: Update `product_ids` array in user record in `data/users.yaml`
+- **Archive Product**: Set `status: archived` in product's `config.yaml`
+
+**What's Already Implemented** (no admin UI needed):
+- ✅ Product model with YAML loading (`app/models/product.py`)
+- ✅ User model with role-based access (`app/models/user.py`)
+- ✅ Multi-product support in submission and dashboard
+- ✅ Product access control (owners see assigned, admins see all)
+- ✅ Archived product blocking (submission route checks status)
+- ✅ Unique submission URLs per product (via submission_url_slug)
+
+**Future Consideration**: If POC proves successful and scaling is needed, Phase 6 tasks below can be implemented to add admin UI.
+
+---
+
+### ~~Tests for User Story 4 (DEFERRED)~~ ⚠️
 
 - [ ] T140 [P] [US4] Contract test for GET /admin/products in tests/contract/test_admin_routes.py
 - [ ] T141 [P] [US4] Contract test for GET /admin/products/new in tests/contract/test_admin_routes.py