test(12): persist human verification items as UAT

.planning/phases/12-p-ytarium-api-collections-and-albums/12-UAT.md

@@ -0,0 +1,48 @@
+---
+status: testing
+phase: 12-p-ytarium-api-collections-and-albums
+source: [12-VERIFICATION.md]
+started: 2026-10-02T15:08:57Z
+updated: 2026-10-02T15:08:57Z
+---
+
+## Current Test
+
+number: 1
+name: Decide on the 12-02 collection-name trimming override
+expected: |
+  Accept an override: the recorded PHP fixture POST___fonoteka_api_v1_collections_jwt.yaml sends '  New Shelf  ' and PHP answers 'New Shelf' (Winter trimStringAttributes); Go trims in Collection.BeforeSave and replays the fixture green.
+awaiting: user response
+
+## Tests
+
+### 1. Decide on the 12-02 collection-name trimming override
+expected: The plan truth "names stored byte-for-byte including spaces" was wrong about Winter; Go trims like PHP and the byte-compatible contract is met.
+result: [pending]
+
+### 2. Read 12-SECURITY-REVIEW.md
+expected: Every T-12 threat's disposition, test and residual risk reads as acceptable (threats_open: 0; T-12-13 accepted; RC-04 partial by design). Self-performed by the 12-05 executor.
+result: [pending]
+
+### 3. Household invitation mail in pl and en in a real mail client
+expected: Layout, copy and link match the PHP collection_invitation mail; footer reads '© Płytarium.' without the year (documented gap).
+result: [pending]
+
+### 4. Read the reworded ROADMAP Phase 12/13/14 and REQUIREMENTS API-01/02/03/07, INTG-01 lines
+expected: They state the Phase 12 boundary locked in 12-CONTEXT (reservations and public token views in Phase 13, cover-price in Phase 14).
+result: [pending]
+
+### 5. Push sm-user-plugin master (c65ab3c, 8697007, c258e9f)
+expected: origin/master contains c258e9f so a fresh fonoteka.go clone can check out submodule pointer f60c3af.
+result: [pending]
+
+## Summary
+
+total: 5
+passed: 0
+issues: 0
+pending: 5
+skipped: 0
+blocked: 0
+
+## Gaps