docs(12.1-04): update state and roadmap after the groups and organisations plan

.planning/STATE.md

@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: "12.1"
 current_phase_name: User plugin admin screens
 status: executing
-stopped_at: Completed 12.1-03-PLAN.md
-last_updated: "2026-10-05T11:34:10.203Z"
+stopped_at: Completed 12.1-04-PLAN.md
+last_updated: "2026-10-05T12:10:04.406Z"
 last_activity: 2026-10-04
 last_activity_desc: Phase 12.1 execution started
-state_head: 76df9c5bd6124d79d84ed67359f46fa347a1d58f
+state_head: 3f4a01ddf87da898d7a2a9acde9b06af880eb4b4
 progress:
   total_phases: 22
   completed_phases: 11
   total_plans: 123
-  completed_plans: 121
+  completed_plans: 122
 milestone_name: milestone
 ---
 
@@ -29,7 +29,7 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 12.1 (User plugin admin screens) — EXECUTING
-Plan: 4 of 5
+Plan: 5 of 5
 Status: Ready to execute
 Last activity: 2026-10-04 — Phase 12.1 execution started
 
@@ -175,6 +175,7 @@ Progress: [██████░░░░] 60%
 | Phase 12.1 P01 | 38min | 4 tasks | 61 files |
 | Phase 12.1 P02 | 12h 43m | 6 tasks | 77 files |
 | Phase 12.1 P03 | 46min | 4 tasks | 40 files |
+| Phase 12.1 P04 | 32min | 4 tasks | 35 files |
 
 ## Accumulated Context
 
@@ -552,6 +553,11 @@ Recent decisions affecting current work:
 - [Phase 12.1]: HasPermission ports Winter line by line: a leading asterisk is a wildcard on the asked code only; PermissionSet.Scan fails on content that is not a JSON object rather than read it as empty
 - [Phase 12.1]: A user created in the admin gets has_self_set_password true and stays not activated; the invitation carries the login and the activation link, never the password
 - [Phase 12.1]: Plugin admin tests boot the plugin alone through newAdminEnv; mail is read from the log driver because the mailer service cannot be replaced after party.Activate
+- [Phase 12.1]: 12.1-04: the user form's groups field is the only writer of users_groups; privileged groups are locked through cabana.RelationLockProvider and need golem15.users.manage_privileged_groups on create and update
+- [Phase 12.1]: 12.1-04: creating a group with a privileged code, changing a code to or from one and deleting a privileged group need the extra permission; name, description and frontend permissions of a privileged group need only access_groups
+- [Phase 12.1]: 12.1-04: Organisation gained the Go relation field Members (no column) because the relation manager requires the relation on the owner model
+- [Phase 12.1]: 12.1-04: the organisation members manager links only users without an organisation; a user moves by unlink then link, or through the user form's organisation field
+- [Phase 12.1]: 12.1-04: nothing was pushed; the fonoteka.go pointer names an unpublished plugin commit, so the order is framework tag, then sm-user-plugin (plan 05 Task 3), then fonoteka.go
 
 ### Pending Todos
 
@@ -604,6 +610,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-05T11:34:09.660Z
-Stopped at: Completed 12.1-03-PLAN.md
+Last session: 2026-10-05T12:09:49.753Z
+Stopped at: Completed 12.1-04-PLAN.md
 Resume file: None