docs(12.1-02): update state and roadmap after the v0.1.3 tag

- plan 3 of 5 next; decisions of plan 02 recorded
- pending: push master and v0.1.3; two application inventory tests

.planning/ROADMAP.md

@@ -649,7 +649,7 @@ Plans:
   5. The new code has unit tests, delivered in the phase's last plan.
 
 **Open questions (discuss-phase):** impersonate user in or out of scope (security-sensitive); a separate permission for granting the `admin` group (it makes a site admin); whether convert-guest is needed for the application's data.
-**Plans:** 1/5 plans executed
+**Plans:** 2/5 plans executed
 
 Plans:
 
@@ -657,7 +657,7 @@ Plans:
 - [x] 12.1-01-PLAN.md — Framework actions (summercms.go): declared bulk actions, record actions, row state and `cabana.ForbiddenError` (403), with READMEs, docs, OpenAPI, TS types, `dist/` and the neutral `acme` fixture
 
 **Wave 2** *(blocked on Wave 1 completion)*
-- [ ] 12.1-02-PLAN.md — Framework preview and form seams (summercms.go): preview context, `permissioneditor`, `password`, form virtual fields, per-operation rules, writable foreign key, locked relation options, `invisible` columns, `preset`; ends with the tag v0.1.3
+- [x] 12.1-02-PLAN.md — Framework preview and form seams (summercms.go): preview context, `permissioneditor`, `password`, form virtual fields, per-operation rules, writable foreign key, locked relation options, `invisible` columns, `preset`; ends with the tag v0.1.3
 
 **Wave 3** *(blocked on Wave 2 completion)*
 - [ ] 12.1-03-PLAN.md — Plugin foundation and the Users screen (sm-user-plugin): additive migrations, permissions, navigation, list, filters, preview, form, bulk and record actions, delete semantics, password and invite, avatar, frontend permission resolver, `last_seen`, and the takeover guard for members of privileged groups (D-30)