docs(13-06): record plan completion in state and roadmap

.planning/ROADMAP.md

@@ -709,7 +709,7 @@ Plans:
   4. Per-user and per-org Discogs/AI credentials CRUD store encrypted values, honor the org-lock flag, and resolve env-to-org-to-user correctly. The live `ai-credential/test` and `discogs-credential/test` routes move to Phase 14 (D-02).
   5. Onboarding, public and invitation-inspection routes, including the anonymous collection views `public/{token}`, `public/{token}/albums` and `public/{token}/albums/{id}`, are reachable without auth and enforce their own public rate-limit buckets.
 
-**Plans:** 5/6 plans executed
+**Plans:** 6/6 plans executed
 
 Plans:
 
@@ -729,7 +729,7 @@ Plans:
 - [x] 13-05-PLAN.md — Public views (6 routes): token resolution, pubfail lockout, public search and facets, public album field set, D-14 per-route buckets, header fix, public flows
 
 **Wave 6** *(blocked on Wave 5 completion)*
-- [ ] 13-06-PLAN.md — Unit tests last: route-table test, request-DTO fuzz, T-13 threat tests, coverage, check-phase13.sh, security review and validation sign-off
+- [x] 13-06-PLAN.md — Unit tests last: route-table test, request-DTO fuzz, T-13 threat tests, coverage, check-phase13.sh, security review and validation sign-off
 
 ### Phase 14: Domain jobs and external integrations
 
@@ -787,7 +787,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 11.1. SummerCMS documentation for humans and AI agents | 7/7 | In Progress|  |
 | 11.2. summercms.io Alpha 0.1 landing page on SummerCMS | 3/3 | In Progress|  |
 | 12. Płytarium API — Collections and Albums | 5/5 | Complete   | 2026-10-02 |
-| 13. Płytarium API — wishlist, notifications, CSV, credentials, public routes | 5/6 | In Progress|  |
+| 13. Płytarium API — wishlist, notifications, CSV, credentials, public routes | 6/6 | In Progress|  |
 | 14. Domain jobs and external integrations | 0/TBD | Not started | - |
 | 15. Cutover | 0/TBD | Not started | - |