docs(13-06): sign off the Phase 13 security review and validation

- 13-SECURITY-REVIEW.md: every T-13 threat with its strictest severity and
  disposition, protecting code, named tests and the 31 removal checks,
  all failing as required; the CSV export logging fix and the Phase 9
  route inventory update
- 13-VALIDATION.md: per-task map 13-01-T1 to 13-06-T3 all green, the gate
  command, coverage per package, Wave 0 ticked, status validated
- REQUIREMENTS.md: API-03, API-04, API-06 and API-07 complete
- deferred-items.md: 13-06 findings (process-wide job dispatcher, scalar
  mapping body, tmpfs quota)

.planning/REQUIREMENTS.md

@@ -75,11 +75,11 @@ Requirements for v1 (the Płytarium port). Each maps to roadmap phases. "User" b
 
 - [x] **API-01**: Collections: CRUD, active-context switch (me/context flags plus the opaque channel name from realtime/channels), editor invitations and acceptance, owner-only share link show/update/regenerate
 - [x] **API-02**: Albums: CRUD, ratings, photo upload and manual cover URL, Discogs cover import (cover_urls), artists/genres/styles lookups, search that treats Typesense as a pre-filter with both the items and the total re-gated in SQL
-- [ ] **API-03**: Wishlist: items, subscriptions, public-wishlist/{token} views, album reservations (reserve/reveal), purchase and digest triggers (the wishlist Discogs match/apply-release routes are Phase 14, with INTG-01)
-- [ ] **API-04**: Notifications: list, unread count, mark read (one and all); pruning is the Phase 14 `fonoteka:prune-notifications` console command; realtime token endpoint owned by the websockets plugin
+- [x] **API-03**: Wishlist: items, subscriptions, public-wishlist/{token} views, album reservations (reserve/reveal), purchase and digest triggers (the wishlist Discogs match/apply-release routes are Phase 14, with INTG-01)
+- [x] **API-04**: Notifications: list, unread count, mark read (one and all); pruning is the Phase 14 `fonoteka:prune-notifications` console command; realtime token endpoint owned by the websockets plugin
 - [x] **API-05**: CSV import as a multi-step session (store, show/poll, mapping patch, per-row edit, commit, cancel) and CSV export on both authenticated groups
-- [ ] **API-06**: Per-user and per-org Discogs and AI credentials CRUD with encrypted storage, org-lock flag, and env-to-org-to-user resolution (the live ai-credential/test and discogs-credential/test routes are Phase 14, with INTG-01 and INTG-02)
-- [ ] **API-07**: Onboarding, public and invitation inspection routes, including the anonymous collection public-token views (public/{token}, its albums and album detail), with their public rate-limit buckets
+- [x] **API-06**: Per-user and per-org Discogs and AI credentials CRUD with encrypted storage, org-lock flag, and env-to-org-to-user resolution (the live ai-credential/test and discogs-credential/test routes are Phase 14, with INTG-01 and INTG-02)
+- [x] **API-07**: Onboarding, public and invitation inspection routes, including the anonymous collection public-token views (public/{token}, its albums and album detail), with their public rate-limit buckets
 - [ ] **API-08**: Feedback submissions and sitemap output from the stack plugins
 - [ ] **API-09**: All 154 routes are registered on the correct groups with identical paths, methods, status codes and bodies
 
@@ -214,11 +214,11 @@ Which phases cover which requirements. Updated during roadmap creation.
 | AUTH-08 | Phase 9 | Complete |
 | API-01 | Phase 12 | Complete |
 | API-02 | Phase 12 | Complete |
-| API-03 | Phase 13 | Pending |
-| API-04 | Phase 13 | Pending |
+| API-03 | Phase 13 | Complete |
+| API-04 | Phase 13 | Complete |
 | API-05 | Phase 13 | Complete |
-| API-06 | Phase 13 | Pending |
-| API-07 | Phase 13 | Pending |
+| API-06 | Phase 13 | Complete |
+| API-07 | Phase 13 | Complete |
 | API-08 | Phase 14 | Pending |
 | API-09 | Phase 15 | Pending |
 | JOBS-01 | Phase 11 | Gaps Found |