docs: sync API and implementation status

Document the shipped acquisition, sales, pricing, dashboard, search, public detail, and image workflows, and update the next hardening milestone.

docs/API.md

@@ -22,6 +22,8 @@ GET /api/v1/public/inventory/:id
 GET /api/v1/public/listings
 GET /api/v1/public/listings/:id
 GET /api/v1/public/sellers
+GET /api/v1/public/lookups/categories
+GET /api/v1/public/lookups/conditions
 GET /api/v1/public/currencies
 GET /api/v1/public/exchange-rates
 ```
@@ -79,7 +81,14 @@ PATCH  /api/v1/admin/inventory/:id/images/order
 POST   /api/v1/admin/images/:id/primary
 DELETE /api/v1/admin/images/:id
 
+GET    /api/v1/admin/acquisitions
+POST   /api/v1/admin/acquisitions
+GET    /api/v1/admin/sales
 POST   /api/v1/admin/sales
+POST   /api/v1/admin/sales/:id/void
+POST   /api/v1/admin/pricing/observations
+POST   /api/v1/admin/inventory/:id/valuation
+POST   /api/v1/admin/inventory/:id/valuation/override
 POST   /api/v1/admin/bulk
 
 GET    /api/v1/admin/dashboard
@@ -105,6 +114,14 @@ Multipart uploads require `width` and `height` fields and validate the binary
 signature before storage. Publication counts persisted inventory images rather
 than trusting a listing request field.
 
+Acquisition, sale, pricing, and dashboard routes are seller-scoped through the
+authenticated admin session. All state-changing routes require the
+session-bound CSRF header. Sale creation marks owned active inventory items as
+`SOLD`; voiding retains the sale record, restores the items to `ACTIVE`, and
+records an audit event. Pricing observations remain private; public listing
+detail exposes only the latest calculated or manually overridden market value,
+condition label, and public image URLs.
+
 ## Provider matching
 
 The API must expose Product-level operations for: