feat(bom): canonical lot mappings and updated vendor spec docs

bible/04-api.md

@@ -89,6 +89,7 @@
 | POST | `/api/sync/pricelists` | Pull pricelists | MariaDB → SQLite |
 | POST | `/api/sync/all` | Full sync: push + pull + import | bidirectional |
 | POST | `/api/sync/repair` | Repair broken entries in pending_changes | SQLite |
+| POST | `/api/sync/partnumber-seen` | Report unresolved/ignored vendor PNs for server-side tracking | QuoteForge → MariaDB |
 
 **If sync is blocked by the readiness guard:** all POST sync methods return `423 Locked` with `reason_code` and `reason_text`.
 
@@ -101,6 +102,14 @@
 | POST | `/api/configs/:uuid/vendor-spec/resolve` | Resolve PNs → LOTs (read-only) |
 | POST | `/api/configs/:uuid/vendor-spec/apply` | Apply resolved LOTs to cart |
 
+Notes:
+- `GET` / `PUT /api/configs/:uuid/vendor-spec` exchange normalized BOM rows (`vendor_spec`), not raw pasted Excel layout.
+- BOM row contract stores canonical LOT mapping list as seen in BOM UI:
+  - `lot_mappings[]`
+  - each mapping contains `lot_name` + `quantity_per_pn`
+- `POST /api/configs/:uuid/vendor-spec/apply` rebuilds cart items from explicit BOM mappings:
+  - all LOTs from `lot_mappings[]`
+
 ### Partnumber Books (read-only)
 
 | Method | Endpoint | Purpose |
@@ -110,6 +119,7 @@
 | POST | `/api/sync/partnumber-books` | Pull book snapshots from MariaDB |
 
 See [09-vendor-spec.md](09-vendor-spec.md) for schema and pull logic.
+See [09-vendor-spec.md](09-vendor-spec.md) for `vendor_spec` JSON schema and BOM UI mapping contract.
 
 ### Export