docs(05-01): drop 27-migrations target and move HTTP fuzz to Phase 12

- DATA-09 and Phase 5 criteria follow D-01 squash and D-07 service-level fuzz
- Phase 12 inherits the write-endpoint DTO fuzz once HTTP exists

.planning/REQUIREMENTS.md

@@ -44,7 +44,7 @@ Requirements for v1 (the Płytarium port). Each maps to roadmap phases. "User" b
 - [ ] **DATA-06**: Mass assignment goes through per-endpoint request DTOs honoring each model's fillable allow-list; serialization honors a hidden deny-list with an explicit per-call override
 - [ ] **DATA-07**: Custom casts exist for jsonable columns, money as a fixed four-decimal string, and encrypted-at-rest secrets (AES-GCM, app-key derived) that are also hidden from serialization
 - [ ] **DATA-08**: A polymorphic file attachment table (owner type, owner id, field, disk path, sort order, public/private) backs attachOne and attachMany, stored via gocloud.dev/blob with the same public URL shape
-- [ ] **DATA-09**: All 25 Płytarium models and 27 migrations are ported with matching table names, columns, indexes and defaults
+- [ ] **DATA-09**: All 25 Płytarium models and their squashed migration set are ported with matching table names, columns, indexes and defaults (migration count is not itself an acceptance number — squashed per plan-time decision D-01 in 05-CONTEXT.md)
 - [ ] **DATA-10**: Paginated responses use the exact `{data, meta{current_page, last_page, per_page, total}}` envelope without a links key
 - [ ] **DATA-11**: Other plugins can hook a model's lifecycle through the GORM callback registry and extend its schema with a companion migration