docs: document the admin compliance-orders surface in the runbook

docs/production-runbook.md

@@ -53,6 +53,24 @@ secret is still the built-in placeholder.
 The startup guard in `api/src/config.ts` (`refuseInsecureProduction`) blocks
 boot if any of the above are unset or still set to `change-this-in-production`.
 
+### Admin surfaces
+
+Both share the same login (`admin_users`, `pw_admin_token` in localStorage):
+
+- `/admin/` — formation orders queue (the original SPA).
+- `/admin/compliance-orders/` — compliance service orders (telecom / DOT /
+  healthcare). Lists orders grouped by batch, flags paid-but-intake-incomplete,
+  shows intake-reminder counts, and exposes two actions:
+  - **Approve & file** — only enabled when `fulfillment_status='ready_to_file'`;
+    flips it to `authorization_signed` and dispatches the worker to submit to
+    the government system. Writes an `order_audit_log` entry.
+  - **Re-arm intake reminder** — clears `intake_reminder_last_at` (optionally
+    resets the count) so the daily `intake_reminder` worker nudges a stalled
+    paid order again. Re-arms the whole batch for multi-service customers.
+
+  Backed by `GET/POST /api/v1/admin/compliance-orders*` in
+  `api/src/routes/admin.ts` (all `requireAdmin`).
+
 ---
 
 ## 2. USAC E-File storage state (Blocker 2)