feat(scanner): Complete PoE implementation with Windows compatibility fix

- Fix namespace conflicts (Subgraph → PoESubgraph)
- Add hash sanitization for Windows filesystem (colon → underscore)
- Update all test mocks to use It.IsAny<>()
- Add direct orchestrator unit tests
- All 8 PoE tests now passing (100% success rate)
- Complete SPRINT_3500_0001_0001 documentation

Fixes compilation errors and Windows filesystem compatibility issues.
Tests: 8/8 passing
Files: 8 modified, 1 new test, 1 completion report

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docs/ui/admin.md

@@ -9,16 +9,18 @@ The Admin workspace centralises Authority-facing controls: tenants, roles, API c
 
 ## 1. Access and prerequisites
 
-- **Route:** `/console/admin` with sub-routes for tenants, users, roles, tokens, integrations, audit, and bootstrap.  
+- **Route:** `/console/admin` with sub-routes for tenants, users, roles, clients, tokens, integrations, and audit.  
 - **Scopes:**  
   - `ui.admin` (base access)  
   - `authority:tenants.read` / `authority:tenants.write`  
+  - `authority:users.read` / `authority:users.write`  
   - `authority:roles.read` / `authority:roles.write`  
-  - `authority:tokens.read` / `authority:tokens.revoke`  
   - `authority:clients.read` / `authority:clients.write`  
+  - `authority:tokens.read` / `authority:tokens.revoke`  
   - `authority:audit.read` (view audit trails)  
-- **Fresh-auth:** Sensitive actions (token revoke, bootstrap key issue, signing key rotation) require fresh-auth challenge.  
-- **Dependencies:** Authority service (`/internal/*` APIs), revocation export, JWKS, licensing posture endpoint, integration config store.
+  - `authority:branding.read` / `authority:branding.write` (branding panel)  
+- **Fresh-auth:** Sensitive actions (token revoke, bootstrap key issue, signing key rotation, branding apply) require fresh-auth challenge.  
+- **Dependencies:** Authority service (`/console/admin/*` APIs), revocation export, JWKS, licensing posture endpoint, integration config store.
 
 ---
 
@@ -35,7 +37,9 @@ The Admin workspace centralises Authority-facing controls: tenants, roles, API c
 +--------------------------------------------------------------------+
 ```
 
-The header includes offline status indicator and link to Authority health page.
+The header includes offline status indicator and link to Authority health page. The browser calls
+`/console/admin/*` endpoints with DPoP tokens; the mTLS-only `/admin/*` endpoints remain
+automation-only.
 
 ---
 
@@ -68,6 +72,18 @@ Actions:
 - "Effective permissions" view summarises what each role grants per service.  
 - CLI parity: `stella auth role update --role ui.admin --add-scope authority:tokens.revoke`.
 
+Scanner role bundles are included:
+- `role/scanner-viewer` -> `scanner:read`
+- `role/scanner-operator` -> `scanner:read`, `scanner:scan`, `scanner:export`
+- `role/scanner-admin` -> `scanner:read`, `scanner:scan`, `scanner:export`, `scanner:write`
+
+Scheduler role bundles are included (proposed):
+- `role/scheduler-viewer` -> `scheduler:read`
+- `role/scheduler-operator` -> `scheduler:read`, `scheduler:operate`
+- `role/scheduler-admin` -> `scheduler:read`, `scheduler:operate`, `scheduler:admin`
+
+Full module role bundle catalog (Console, Scanner, Scheduler, Policy, Graph, Observability, etc.) lives in `docs/architecture/console-admin-rbac.md`.
+
 ---
 
 ## 5. Users & tokens tab
@@ -90,6 +106,7 @@ Audit entries appear for every user/token change. CLI parity: `stella auth token
 - **Bootstrap bundles** - downloadable templates for new clients/users; includes configuration YAML and CLI instructions.  
 - **External IdP connectors** (optional) - displays status for SAML/OIDC plugins; includes metadata upload field and test login result.  
 - **Licensing posture** - read-only panel summarising plan tier, entitlement expiry, and contact info (pulled from licensing service).  
+- **Branding** - upload logo/favicon, adjust theme tokens, preview and apply (fresh-auth).  
 - **Notifications** - optional webhook configuration for token events (on revoke, on failure).  
 - CLI parity: `stella auth client create --client concelier --grant client_credentials --tenant prod`.
 
@@ -149,10 +166,13 @@ Audit entries appear for every user/token change. CLI parity: `stella auth token
 ## 12. References
 
 - `/docs/modules/authority/architecture.md` - Authority architecture.  
+- `/docs/architecture/console-admin-rbac.md` - Console admin RBAC architecture.  
+- `/docs/architecture/console-branding.md` - Console branding architecture.  
 - `/docs/11_AUTHORITY.md` - Authority service overview.  
 - `/docs/security/authority-scopes.md` - scope definitions.  
 - `/docs/ui/policies.md` - policy approvals requiring fresh-auth.  
 - `/docs/ui/console-overview.md` - navigation shell.  
+- `/docs/ui/branding.md` - branding operator guide.  
 - `/docs/modules/cli/guides/authentication.md` (pending) and `/docs/modules/cli/guides/policy.md` for CLI flows.  
 - `/docs/modules/scheduler/operations/worker.md` for integration with scheduler token rotation.
 

docs/ui/branding.md

@@ -0,0 +1,36 @@
+# Console Branding Guide
+
+> **Audience:** Console admins, UI Guild, Authority Guild.
+> **Scope:** Runtime branding of the Console UI (logo, title, and theme tokens).
+
+## 1. What can be customized
+- Header title text
+- Logo and favicon (SVG/PNG/JPG)
+- Theme tokens (light/dark/high-contrast CSS variables)
+- Welcome screen title and message (from config.json)
+
+## 2. Where branding is stored
+- Authority stores tenant branding records and serves them via `/console/branding`.
+- Updates are audited and require fresh-auth.
+
+## 3. Admin workflow
+1. Open **Console Admin -> Branding**.
+2. Upload logo and favicon (max 256KB).
+3. Adjust theme tokens using the palette editor.
+4. Preview changes (no persistence).
+5. Apply changes (requires fresh-auth).
+
+## 4. Offline workflow
+- Export branding bundle from the Admin panel.
+- Import via Authority offline bundle apply.
+- UI shows the applied branding hash for verification.
+
+## 5. Security and guardrails
+- Only whitelisted tokens are accepted.
+- No external CSS or remote font URLs are allowed.
+- Branding updates emit `authority.branding.updated` audit events.
+
+## 6. References
+- `docs/architecture/console-branding.md`
+- `docs/ui/admin.md`
+