fix(#478): register the restore route the Trash panel has been calling

[guycorbaz]

Closes #478.

The bug

templates/fragments/admin_trash_panel.html has rendered a Restore button since story 8-6, calling /admin/trash/{table}/{id}/restore. That route was never registered. The click returned 404, HTMX does not swap a 4xx — so it produced nothing: no restore, no error, no feedback entry.

The suite never noticed because TrashService::restore and restore_with_conflicts_cleared had no caller outside #[cfg(test)]. Meanwhile CLAUDE.md promises soft delete with the Trash as the recovery path, and auto_purge hard-deletes after 30 days — so in practice nothing deleted by mistake was recoverable through the UI at all.

Landing this required #480 first (merged): with the seed gate only soft-deleting, a working Restore button would have handed back the admin/admin account documented in SECURITY.md.

The change

• POST /admin/trash/{table}/{id}/restore, not the GET the button emitted. A state-changing GET sits outside the story 8-2 CSRF layer (which guards POST/PUT/PATCH/DELETE) and is fair game for any prefetcher. The button posts; csrf.js supplies the header.
• The panel filters and page ride the URL, so the post-restore re-render lands the admin back on the view they were on — same contract as the permanent-delete sibling (patch P12).
• Conflict path. When relationships changed while the item sat in the trash, the first pass returns the UX-DR8 conflict modal, retargeted into #modal-slot, listing exactly what the Confirm would clear; the Confirm re-posts with clear_conflicts=1 → restore_with_conflicts_cleared. The admin.trash.restore_modal_* keys for this flow had been sitting unused in both locale files since story 8-6. A conflict-free restore stays one click.
• Audit. A restore writes an admin_audit row (restore_from_trash, with actor username/role and whether conflicts were cleared) — the inverse of a purge belongs in the same trail. Best-effort: the restore has already committed, so a failed audit INSERT must not turn a successful action into an error page.
• One new locale key in EN + FR for the "already gone" case; everything else was already translated.
• The Restore button gained data-modal-trigger (focus anchor for the conflict modal), which made button[data-modal-trigger] ambiguous inside a trash row — admin-permanent-delete.spec.ts now addresses its button by accessible name, which the selector policy prefers anyway.

Coverage

Rust — tests/admin_trash_restore.rs, nine tests over HTTP through build_router, so the wiring is covered and not just the service: the route restores and reports; a librarian is refused; a request with no CSRF token is rejected (the reason POST matters); a stale version is 409 and leaves the row in the trash; a purged row is 404 with the operator-facing copy; a table outside ALLOWED_TABLES is 400; an audit row is written; the conflict modal is returned with HX-Retarget: #modal-slot and changes nothing; the confirm pass restores and drops the stale link.

Browser — tests/e2e/specs/journeys/admin-trash-restore.spec.ts: delete a borrower → find it in the Trash → Restore → the feedback names it, the row disappears, the borrower is back in its list. A second test replays the same request from a stale panel and asserts the operator gets the "already gone" copy rather than the silence #478 is about. The journey uses a borrower rather than a series on purpose: a restore leaves the entity live, and empty-states.spec.ts asserts the /series list is empty.

Testing

• cargo clippy --all-targets -- -D warnings — clean.
• cargo test --lib — 1171 passed (includes templates_audit).
• cargo test --test admin_trash_restore — 9 passed.
• CI=true npx playwright test --workers=2 on a freshly reset stack — 332 passed, 2 skipped, 0 failed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D5cV9QRqQAFpiNKZwZfoNX