docs(12.1-03): complete plugin foundation and Users screen plan

.planning/phases/12.1-user-plugin-admin-screens/deferred-items.md

@@ -9,3 +9,12 @@
   **Why not fixed here:** the fix is two fixed lists in the application repository (fonoteka.go); plan 12.1-02 writes to summercms.go only. No framework change is needed, so the tagged commit is not affected. The same catch-up was done once before (`549840d test(13-06): list the Phase 12.2 cabana admin routes in the Phase 9 route inventory`).
   **Why the gate missed it:** the plan's application gate `go -C ../fonoteka.go test ./... -count=1` runs the root module only; the go.work plugin modules (`plugins/golem15/{user,fonoteka,golem,feedback}`) are separate modules and are not matched by `./...`.
   **Suggested owner:** plan 12.1-04 (it already writes the application's parity allow-list entry and submodule pointer) or plan 12.1-05's gate script, which should run every workspace module.
+
+- Four more application tests fail once the user plugin registers its admin screen, its three migrations and the FrontendPermission model
+  status: open
+  **Found:** plan 12.1-03 Tasks 1 and 3, 2026-10-05. The application's go.work uses the plugin's working tree, so these fail as soon as the plugin commits exist, before any submodule pointer bump.
+  **What:** (1) `TestAdminMetadataFiltering` (`plugins/golem15/fonoteka/admin_metadata_test.go`) expects the developer role's navigation to be exactly `[fonoteka]`; it is now `[fonoteka user]`, because the four Winter permission codes of the user plugin default to the developer role (D-02, D-04). (2) `TestMigrateSeedsCanonicalGenres` and `TestRollbackLastIsolatesFonoteka` (`parity/migrate_test.go`) compare the user plugin's migration history with a fixed id list, which lacks `202610040001_add_users_permissions`, `202610040002_add_users_last_seen` and `202610040003_create_frontend_permissions`. In history order (by id) the first of them sorts before the shipped `202610040001_create_user_api_tokens`. (3) `TestHiddenNeverMarshals` (`plugins/golem15/fonoteka/classes/hidden_marshal_test.go`) pins `expectedUserModels = 5`; the user plugin now registers six models (`FrontendPermission` is new). With the constant at 6 (checked through a `go test -overlay` copy, nothing written to the repository) the test passes, so the marshalling checks themselves hold for the new model and the new `User` fields.
+  **Already known, same run:** `TestSchemaMatchesPHPSnapshot` reports the new table `golem15_user_frontend_permissions` until plan 04 adds its allow-list entry (stated in the 12.1-03 plan).
+  **Why not fixed here:** all of them are fixed lists or counts in the application repository (fonoteka.go). Plan 12.1-03 commits only inside the plugin checkout.
+  **Effect on plan 12.1-03's own verify:** the command `go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestAdmin|TestPhase09|TestPhase10|TestPhase12Threats)'` cannot be green before plan 04: it matches `TestAdminMetadataFiltering` and the two tests of the entry above. Every other test that pattern selects passes.
+  **Suggested owner:** plan 12.1-04, together with the entry above.