docs(phase-19.6.1): update tracking after wave 3

.planning/ROADMAP.md

@@ -1423,7 +1423,7 @@ Plans:
   2. Privilege rules hold on the server: only a superuser can create, edit or grant superuser; an admin cannot raise their own role or permissions; the last active superuser cannot be deactivated, demoted or deleted.
   3. The record-action seam on the Administrators list is usable by plugins (19.7's link action), and unit tests cover the privilege rules.
 
-**Plans:** 2/3 plans executed
+**Plans:** 3/3 plans executed
 
 Plans:
 **Wave 1**
@@ -1433,7 +1433,7 @@ Plans:
 - [x] 19.6.1-02-PLAN.md — SPA support (D-21): per-record locked permission values and the field `trigger`, regenerated OpenAPI and schema.d.ts, rebuilt modules/boardwalk/dist
 
 **Wave 3** *(blocked on Wave 2 completion)*
-- [ ] 19.6.1-03-PLAN.md — unit, Postgres and SPA tests for every rule (incl. the held-lock last-superuser race), the seam and D-21, plus the check-phase19.6.1.sh gate
+- [x] 19.6.1-03-PLAN.md — unit, Postgres and SPA tests for every rule (incl. the held-lock last-superuser race), the seam and D-21, plus the check-phase19.6.1.sh gate
 
 ### Phase 19.7: Generic MCP module (INSERTED)
 
@@ -1588,7 +1588,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 19.4.1. Early public demo on demo.summercms.io | 5/5 | In Progress|  |
 | 19.5. Social login in sm-user-plugin | 5/5 | Complete    | 2026-10-21 |
 | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |
-| 19.6.1. Backend Administrators screen (INSERTED) | 2/3 | In Progress|  |
+| 19.6.1. Backend Administrators screen (INSERTED) | 3/3 | In Progress|  |
 | 19.7. Generic MCP module | 0/TBD | Not started | - |
 | 19.8. Console commands overhaul (INSERTED) | 6/6 | In Progress|  |
 | 20. Demo instance with every shared plugin | 0/TBD | Not started | - |