Completed in commit 4ae72d6: added docs/roles-and-permissions.md with role model, permissions matrix, enforcement approach (JWT role + middleware), and mandatory audit events.
Completed in commit e718baa: added docs/dispute-flow.md with status model (open/evidence/mediation/resolved/cancelled), required dispute payload, escalation/decision rules, immutable dispute_events…
Completed in commit 7bab2b3: added docs/api-versioning.md with concrete major-version, deprecation, sunset, and compatibility policy.
Completed in commit 7bab2b3: synchronized docs/openapi.yaml with current API contract and documented source-of-truth OpenAPI files in README.
Implemented on main in commit f7062f2. Added full OpenAPI 3.1 spec for all current backend routes in openapi.yaml (health, auth, requests, offers, contacts, addresses, profile, reviews).