docs(06-08): update plan tracking

- Advance phase progress to 8 of 11 plans
- Record transition-address security decisions and execution metrics
- Mark HTTP-07 complete in requirements tracking

.planning/REQUIREMENTS.md

@@ -56,7 +56,7 @@ Requirements for v1 (the Płytarium port). Each maps to roadmap phases. "User" b
 - [x] **HTTP-04**: A rate limiter supports named buckets keyed by a resolver (token id, IP, route param), stacking two limiters on one route, and ports Płytarium's five named buckets and inline throttles 1:1
 - [x] **HTTP-05**: An auth guard registry lets plugins add guards (JWT, personal token, OAuth bearer) that all resolve to the same current-user accessor
 - [ ] **HTTP-06**: Response conventions are preserved: empty arrays serialize as [], timestamps as +00:00, tri-state booleans keep null, conditional keys are omitted not nulled, and no blanket envelope or error middleware wraps OAuth routes
-- [ ] **HTTP-07**: A guarded outbound fetch helper enforces host allow-lists, byte caps and timeouts for user-supplied URLs (manual cover URL, Discogs cover)
+- [x] **HTTP-07**: A guarded outbound fetch helper enforces host allow-lists, byte caps and timeouts for user-supplied URLs (manual cover URL, Discogs cover)
 - [x] **HTTP-08**: OpenAPI is generated from swaggo/swag annotations on handlers and openapi-typescript produces the admin SPA's types
 - [x] **HTTP-09**: CORS and JSON body size limits match the PHP deployment
 
@@ -189,7 +189,7 @@ Which phases cover which requirements. Updated during roadmap creation.
 | HTTP-04 | Phase 6 | In Progress |
 | HTTP-05 | Phase 6 | Complete |
 | HTTP-06 | Phase 6 | In Progress |
-| HTTP-07 | Phase 6 | In Progress |
+| HTTP-07 | Phase 6 | Complete |
 | HTTP-08 | Phase 6 | Complete |
 | HTTP-09 | Phase 6 | Complete |
 | AUTH-01 | Phase 7 | Pending |