docs(website): record the PR 4 admin router split and the end of admin.routes.js

Covers website PR 4, the last admin split PR: shard (16), uo-link (5), email
(6), discord-bot (2), settings (2) and dashboard/site-mode (2) leave the
residual file, which is deleted. The admin group is fully split.

API_V2_PLAN.md gains a "PR 4 — as landed" section recording the two decisions a
reviewer would otherwise have to reconstruct: dashboard.router.js is mounted at
the group root (the single relaxation of the mount-at-a-prefix rule, safe only
because it declares no router-level middleware), and /shard keeps two gate tiers
in one router because prefix ownership beats swagger-tag grouping. Sequencing
item 7 is marked landed; PR 5 (public/player/auth) is the only split PR left.

BACKEND_DESIGN.md §2 gets the six new routers in the folder tree and drops the
residual entry; §4's /admin preamble now describes the ops/config gates instead
of pointing at a file that no longer exists.

WIKI_UPGRADE.md's two links into admin.routes.js are repointed at wiki.router.js
and admin/imageUpload.js.

Co-Authored-By: Claude <noreply@anthropic.com>

website/BACKEND_DESIGN.md

@@ -34,10 +34,12 @@ Skeleton from the spec, with a small number of justified additions marked **(+)*
 > every URL unchanged**. This section and §4 get updated as each split PR lands. See
 > [API_V2_PLAN.md](./API_V2_PLAN.md) § Phase 2.
 >
-> **Landed so far:** admin `users`, `account`, `invites`, `auth/providers` (PR 1, 28 routes),
-> `moderation`, `bot-activity`, `activity` (PR 2, 18 routes) and `posts`, `uploads`, `wiki`, `pages`
-> (PR 3, 31 routes) now live in their own routers under `admin/`, behind a new `admin/index.js`. The
-> remaining 33 admin routes are still in `admin.routes.js`, and `public/` and `player/` are untouched.
+> **Landed so far:** the **admin group is fully split**. `users`, `account`, `invites`,
+> `auth/providers` (PR 1, 28 routes), `moderation`, `bot-activity`, `activity` (PR 2, 18 routes),
+> `posts`, `uploads`, `wiki`, `pages` (PR 3, 31 routes) and `shard`, `uo-link`, `email`,
+> `discord-bot`, `settings`, `dashboard`/`site-mode` (PR 4, 33 routes) each live in their own router
+> under `admin/`, behind `admin/index.js` — **`admin.routes.js` is deleted**. `public/` and `player/`
+> are untouched and are the subject of the last split PR.
 >
 > "Every URL unchanged" is enforced mechanically, not by review: `server/scripts/routeManifest.js`
 > (`npm run routes:manifest`) walks the live Express stack and writes the sorted
@@ -83,9 +85,24 @@ server/
                  pages.router.js         (7)  /admin/pages    — CMS page builder
                  imageUpload.js               shared multer config for the two
                                               upload routes above (not a router)
-                 admin.routes.js        (33)  everything not yet split, mounted
-                                              last at the group root; goes away
-                                              when the final split PR lands
+                 shard.router.js        (16)  /admin/shard    — 7 self-service
+                                              account-linking routes (no extra
+                                              gate, handlers shared with
+                                              /player/shard) + 9 in-game staff
+                                              ops on modAccess, per route
+                 uoLink.router.js        (5)  /admin/uo-link  — sidecar config,
+                                              town crier, admin SSE — adminOnly
+                 email.router.js         (6)  /admin/email    — Gmail OAuth2
+                                              delivery — adminOnly
+                 discordBot.router.js    (2)  /admin/discord-bot — adminOnly
+                 settings.router.js      (2)  /admin/settings — adminOnly
+                 dashboard.router.js     (2)  GET /dashboard (staff-wide) and
+                                              PUT /site-mode (adminOnly) — the
+                                              two singletons owning no path
+                                              segment, so mounted at the group
+                                              root; declares no router-level
+                                              middleware, which is what makes a
+                                              root mount safe
                  admin.controller.js + the per-capability controllers
                                    (already domain-split; the split PRs re-wire
                                    routes, not logic)
@@ -478,9 +495,11 @@ Public content GETs pass through the **siteMode** gate (§5).
 `users`, `invites`, `auth/providers` and `bot-activity` add `adminOnly` on top, and `moderation` adds
 `modAccess` (admin + moderator, so editors are excluded). The content capabilities — `posts`,
 `uploads`, `wiki`, `pages` — add nothing: managing content is the editor tier's job, so `staffOnly` is
-the whole gate. Routes not yet extracted still live in `admin.routes.js`, mounted last at the group
-root. The URLs below are unaffected by which file a route currently sits in — that is the property the
-route manifest freezes.
+the whole gate. The ops/config capabilities — `uo-link`, `email`, `discord-bot`, `settings`, and
+`PUT /site-mode` — are `adminOnly`; `shard` is the one mixed prefix, where self-service account
+linking carries no extra gate and the in-game staff operations carry `modAccess`. There is no residual
+file: every admin route is declared in a capability router. The URLs below are unaffected by which
+file a route sits in — that is the property the route manifest freezes.
 | Method | Path | Purpose |
 |---|---|---|
 | GET | `/dashboard` | current mode, last change time + who, content counts, recent activity |