docs(06-02): correct HTTP-04 named bucket count to five

- ROADMAP Phase 6 success criterion 2 and REQUIREMENTS HTTP-04 said seven
- D-01: routes.php defines five fonoteka-* buckets plus inline throttle:N,M

.planning/ROADMAP.md

@@ -218,7 +218,7 @@ Plans:
 **Success Criteria** (what must be TRUE):
 
   1. The same handler serves both a JWT-authenticated request under `/_fonoteka/api/v1` and a personal-token request under `/api/v1/fonoteka`, with public/onboarding groups reachable without auth; unknown and malformed ids on ownership-scoped resources both return 404.
-  2. All seven named rate-limit buckets are enforced with the documented keys and limits, including a route stacking two limiters.
+  2. All five named rate-limit buckets are enforced with the documented keys and limits, including a route stacking two limiters.
   3. Response conventions hold under test: empty arrays serialize as `[]`, timestamps carry `+00:00`, tri-state booleans keep `null`, conditional keys are omitted not nulled; an OAuth-group route carries no house envelope or error middleware, verified by route-registration inspection.
   4. The guarded outbound fetch helper rejects a non-allow-listed host and enforces a byte cap and timeout on a user-supplied cover URL fetch (manual cover URL, Discogs cover).
   5. OpenAPI is generated from swaggo/swag annotations on handlers and `openapi-typescript` produces valid TypeScript types from it; CORS and JSON body-size limits match the PHP deployment.