docs(07): record the phase goal verification

The six plans are in, and three of the four success criteria hold. AUTH-01 stays blocked because the 15 user API routes are still pending against the recorded PHP bodies.

Co-authored-by: Cursor <cursoragent@cursor.com>

.planning/phases/07-user-plugin-and-authentication/07-REVIEW.md

@@ -0,0 +1,42 @@
+---
+phase: 07-user-plugin-and-authentication
+reviewed: 2026-09-22T17:26:00Z
+depth: standard
+files_reviewed: 4
+files_reviewed_list:
+  - ../fonoteka.go/plugins/golem15/user/controllers/api_controller.go
+  - ../fonoteka.go/parity/schema_diff_test.go
+  - ../fonoteka.go/parity/manifest.yaml
+  - bouncer/phase07_coverage_test.go
+findings:
+  critical: 0
+  warning: 2
+  info: 0
+  total: 2
+status: issues_found
+---
+
+# Phase 7: Code Review Report
+
+**Reviewed:** 2026-09-22T17:26:00Z
+**Depth:** standard
+**Files Reviewed:** 4
+**Status:** issues_found
+
+## Summary
+
+The session, token, and lock tests match the handlers they name. Two response differences against the recorded PHP corpus are still in the Go handlers. Neither is a new crash or a secret leak. Both keep the user API routes pending.
+
+## Warnings
+
+### 1. Wrong activation code returns 200
+
+`Activate` ignores the error from `VerifyActivationCode` and always writes the user payload at status 200. The isolated PHP app throws and returns the HTML error page at status 500 for `POST /_user/api/v1/activate` with `{"code":"wrong"}` and for `POST /_user/api/v1/activate-by-code` with `1!nope`. The fixtures record the HTML. The Go handler was left as-is in 07-05.
+
+### 2. Logout blacklists a token PHP still accepts
+
+Go logout adds the presented jti to `jwt_blacklist`, so the next fetch is 401. PHP logout returns `{"message":"Logged out"}` and a following fetch with that bearer is still 200. `TestSessionSequence` locks in the Go behavior. The recorded fixtures lock in the PHP behavior. The routes stay `pending`.
+
+## Info
+
+None.