docs(09-12): record the phase 9 acceptance evidence

- Security review names the test that fails if each high control is removed.
- Validation rows now point at the phase gate commands.
- Roadmap shows 12/12 plans executed.

.planning/ROADMAP.md

@@ -375,7 +375,7 @@ Plans:
   4. The relation-manager schema supports search/link/unlink/manage-or-view lists for Collections' editors tab, replacing the `partial` field entirely.
   5. Admin CRUD endpoints expose `listExtendQuery`/`formExtendQuery`/`formBeforeCreate`/`formBeforeUpdate`/`relationExtendManageQuery` hooks, bulk delete runs each record's lifecycle hooks, and the Settings model binds to a settings screen through the same schema pipeline.
 
-**Plans**: 8/12 plans executed
+**Plans**: 12/12 plans executed
 **Research flag:** yes
 
 Plans:
@@ -408,7 +408,7 @@ Plans:
 - [x] 09-11-PLAN.md — Complete permissions, navigation, and singleton settings
 
 **Wave 9** *(blocked on Wave 8 completion)*
-- [ ] 09-12-PLAN.md — Close with security, PostgreSQL, OpenAPI, and acceptance gates
+- [x] 09-12-PLAN.md — Close with security, PostgreSQL, OpenAPI, and acceptance gates
 
 ### Phase 10: Admin Vue SPA
 
@@ -529,7 +529,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 6. HTTP routing, auth groups and rate limiting | 14/14 | Complete   | 2026-09-21 |
 | 7. User plugin and authentication | 8/8 | Complete    | 2026-09-23 |
 | 8. OAuth2.1 authorization server | 10/10 | Complete   | 2026-09-23 |
-| 9. Backend admin authentication and schema pipeline | 11/12 | In Progress|  |
+| 9. Backend admin authentication and schema pipeline | 12/12 | In Progress|  |
 | 10. Admin Vue SPA | 0/TBD | Not started | - |
 | 11. Jobs, realtime and search infrastructure | 0/TBD | Not started | - |
 | 12. Płytarium API — Collections and Albums | 0/TBD | Not started | - |