chore: collapse to the React-super-layer — drop the local API, the API tests, and excess docs (#544) (#550)

Owner directive 2026-05-28: "this library implements no API at all! it
requires the django-admin-rest-api as prerequisited because it relies
on it to put the react layer on top. Next clean up everything that is
not directly linked to this: relying on the react admin rest api
endpoints to put the React app on top of it."

Also: "eliminate the excess of md files and keep only the most relevant
ones." Survivors: README (product sales page), ARCHITECTURE, SECURITY,
LICENSE.

## What this PR does

- **Bumps `django-admin-rest-api` → `^1.0.0`** (the v1 the owner just
  shipped to PyPI).
- **Deletes `django_admin_react/api/` entirely** — every endpoint, the
  serializer denylist, the permission gates, the wire-level helpers.
  None of it lived in this repo's mandate any more.
- **Swaps `django_admin_react/urls.py`** to `include("django_admin_rest_api.api.urls")`
  at the `api/v1/` prefix the SPA already expects. The wire shape is
  identical (it's literally the same code, just imported from PyPI).
- **`views.py` / `pwa.py`** now import the staff-gate + admin-site
  lookup from `django_admin_rest_api.api.{permissions,registry}` — the
  package is the single source of truth for those helpers.
- **`tests/test_project/settings.py`** gets `"django_admin_rest_api"`
  in `INSTALLED_APPS` alongside this package, mirroring what consumers
  do.
- **Deletes 36 API-test files** — every list / detail / create / update /
  delete / actions / inlines / autocomplete / history / panels / etc.
  test belongs to the API repo's suite; this repo's tests now cover
  only what's still SPA-side: `test_spa_index.py`, `test_pwa.py`,
  `test_login.py` (the package's own login that replaces the legacy
  admin login).
- **Deletes 9 excess root .md files**: ACCEPTANCE / API_CONTRACT /
  CHANGELOG / CLAUDE / CONTRIBUTING / DESIGN_SYSTEM / ONBOARDING /
  PRODUCT_VISION / TESTING. Survivors are README + ARCHITECTURE +
  SECURITY + LICENSE; their cross-links to the deleted files are
  rewritten or removed.

## Verification
- `poetry lock` + `poetry install` resolve cleanly with the v1 dep.
- `poetry run pytest` → **42 passed** (covers the SPA mount, the PWA,
  the package's own login). The 87% line coverage on what remains is
  the right number: this repo's runtime surface is now narrow and
  fully exercised.
- No remaining `django_admin_react.api.*` imports anywhere in
  `django_admin_react/` or `tests/`.

Refs #544 (Phases 2 + 3 + 4 collapsed into one).

Co-authored-by: Martin Castro Laminrs <mcastro@laminr.ai>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

ACCEPTANCE.md

@@ -153,9 +153,7 @@ django-admin-react/
 │
 ├── ARCHITECTURE.md              # ← you are here
 ├── SECURITY.md
-├── CONTRIBUTING.md
-├── CLAUDE.md                    # Required reading for AI agents
-├── README.md
+├── README.md                    # product sales page + install + 3-repo links
 ├── LICENSE
 └── pyproject.toml               # Poetry-managed
 ```
@@ -165,7 +163,7 @@ Live status / backlog / coordination lives on GitHub (Issues, the
 Discussions, PR review comments), not in committed markdown.
 
 Every folder above has its own `README.md` describing its purpose and what
-belongs there. This is enforced in [`CLAUDE.md`](CLAUDE.md).
+belongs there.
 
 ---