docs(phase-19.5): update tracking after wave 4

.planning/ROADMAP.md

@@ -1363,7 +1363,7 @@ Plans:
   3. Identities are linked on login and listed and unlinked through the existing identity routes. Both applications that consume the plugin still build and pass their tests.
   4. The new code has unit tests, delivered in the phase's last plan.
 
-**Plans:** 3/4 plans executed
+**Plans:** 4/4 plans executed
 
 Plans:
 **Wave 1**
@@ -1376,7 +1376,7 @@ Plans:
 - [x] 19.5-03-PLAN.md — Adoption: sm-demo-app mount next to the OIDC provider, sm-bm-app Microsoft 365 (backend, `/oauth` reserved, frontend callback, consent and link views), fonoteka.go green at the bumped user-plugin pin (wave 3)
 
 **Wave 4** *(blocked on Wave 3 completion)*
-- [ ] 19.5-04-PLAN.md — Unit tests for every decision, PHP social-auth test map, security review, scripts/check-phase19.5.sh (wave 4)
+- [x] 19.5-04-PLAN.md — Unit tests for every decision, PHP social-auth test map, security review, scripts/check-phase19.5.sh (wave 4)
 
 ### Phase 19.6: Two-factor auth and device flow in sm-user-plugin (INSERTED)
 
@@ -1536,7 +1536,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 19.3. Framework transport and infrastructure for WavePath | 6/6 | In Progress|  |
 | 19.4. OIDC provider on wristband | 4/4 | Complete    | 2026-10-20 |
 | 19.4.1. Early public demo on demo.summercms.io | 5/5 | In Progress|  |
-| 19.5. Social login in sm-user-plugin | 3/4 | In Progress|  |
+| 19.5. Social login in sm-user-plugin | 4/4 | In Progress|  |
 | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |
 | 19.7. Generic MCP module | 0/TBD | Not started | - |
 | 19.8. Console commands overhaul (INSERTED) | 0/TBD | Not started | - |