Merge branch 'phase/35-appropriateness'

# Conflicts:
#	docs/phases/README.md

docs/protocol.md

@@ -379,6 +379,34 @@ land under `saves/{id}.portraits/` and survive until the school is deleted.
 `GET /api/status` includes `swarmUiConfigured` and `swarmUiConnected` (`null` when not configured)
 so the client can disable generate buttons and show reachability without trying POST first.
 
+### `GET /api/schools/{id}/dress-rules`
+
+Student and staff dress-code pairs for the school. Unknown `{id}` is `404` `unknown-school`.
+
+`form` is one of `regular`, `short`, `strict`. `color` is one of `noBright`, `whiteTopBlackBottom`,
+`free`. When a `POST` has been accepted but not yet applied, `pendingStudents` and/or `pendingStaff`
+show what takes effect on the **next work morning** (six o'clock on a weekday outside holidays) —
+not immediately.
+
+```json
+{
+  "students": { "form": "regular", "color": "noBright" },
+  "staff": { "form": "regular", "color": "noBright" },
+  "pendingStudents": null,
+  "pendingStaff": null
+}
+```
+
+### `POST /api/schools/{id}/dress-rules`
+
+Queues a change for the next work morning. Either or both of `students` and `staff` may be sent;
+omitted sides keep their current rule. Unknown `{id}` is `404` `unknown-school`. Unknown `form` or
+`color` is `400` `unknown-form` / `400` `unknown-color`. Response body matches `GET`.
+
+```json
+{ "students": { "form": "strict", "color": "noBright" } }
+```
+
 ### `GET /api/schools/{id}/staffing`
 
 Money, uncovered subjects, the applicant pool and current staff. Reads the **published**