docs(12.1): create phase plan

.planning/phases/12.1-user-plugin-admin-screens/12.1-CONTEXT.md

@@ -60,6 +60,9 @@ Out of scope: impersonating a user, the guest concept and convert-guest, MailBlo
 - **D-28:** G5 is solved with an optional controller interface that returns the rule set per operation, not with a wrapper record type in the plugin.
 - **D-29:** The research recommendations for the remaining open questions are accepted: User Groups keep the standard form delete, guarded per D-06, with pivot cleanup; `last_seen` is written on login and on refresh, at most once per five minutes, and a failed write never fails auth; a user created in the admin starts not activated and only the `activate` actions set `is_activated`; bulk `activate` skips users that are already active and reports the affected count.
 
+### Plan-check decision (confirmed 2026-10-04)
+- **D-30:** A user who is a member of a privileged group (D-05) is protected against takeover. Changing that user's password or email, and permanently deleting them (form delete and bulk delete), additionally requires the D-04 permission. Without it the request is refused with a forbidden error and changes nothing (no partial save; a bulk delete containing such a user is refused as a whole). This deliberately differs from PHP, where `access_users` alone is enough. — **Reversibility:** cheap — a server-side check in the plugin; no contract or schema change.
+
 ### Claude's Discretion
 - The code of the extra permission in D-04 (for example `golem15.users.manage_privileged_groups`), its label and tab, and the config key name for the privileged list.
 - YAML keys and Go interface names for bulk actions, record actions, preview and row state, provided they follow the existing fail-loud rules (unknown keys and unregistered actions are boot errors), sit under the `{prefix}/api/v1/{vendor}/{plugin}/{controller}/...` scheme, use `requireAjax` on writes and carry swag annotations.