docs(spec): approve dashboard planning gate

docs/DASHBOARD-UX-SPEC.md

@@ -1,6 +1,6 @@
 # Dashboard UX Specification
 
-- Status: Draft for product/design approval — implementation is not authorized
+- Status: Approved UX specification — implementation planning authorized; implementation is not yet authorized
 - Product: ZarinPal Merchant Analytics hackathon dashboard
 - Audience: non-technical Persian-speaking merchants, hackathon judges, finance/legal handoff recipients
 - Direction: Persian-first RTL
@@ -782,7 +782,7 @@ No implementation work begins until the dashboard capability and this UX specifi
 
 ## 21. Remaining approval questions
 
-1. What is the approved CSV interface contract: eligible detail types, exact columns/headers, UTF-8/BOM policy, canonical date fields, filename, row cap, synchronous versus asynchronous delivery, retention, and audit event?
+1. Approve or revise the backend draft CSV contract: synchronous delivery, eligible detail types/columns, UTF-8 BOM, ASCII `snake_case` headers, UTC timestamps, filename policy, 100,000-row/50-MiB caps, 60-second deadline, throttling, retention, and audit event.
 2. Should CSV preflight be a modal dialog on desktop or an inline disclosure, provided the mobile experience remains a focus-managed full-screen dialog/sheet?
-3. Which non-sensitive merchant display field is authoritative for the shell/export preflight when the demo account username and merchant business name differ?
+3. Approve the draft `AuthSession.merchant.displayName` field as authoritative for the shell and export preflight when the demo username differs.
 4. Is a downloadable chart-data table required in MVP, or is a visible semantic table alternative sufficient while CSV remains limited to authorized detail views?