docs(11-03): record the websockets plugin dissolution (D-16) and the RT-01 client note

- PROJECT.md: websockets is not a separate app plugin; Key Decisions row
- REQUIREMENTS.md: RT-01 names a hand-rolled Centrifugo client (D-12)

.planning/PROJECT.md

@@ -134,7 +134,7 @@ Quality
 - **Compatibility**: `vue-fonoteka-app` and `fonoteka-mcp` must run unchanged; the Nuxt app's requests define the contract and response shapes are not improved during the port
 - **Realtime**: keep the Centrifugo server and port only the publisher and token issuing — the Nuxt client connects to Centrifugo directly
 - **Plugins**: compiled at build time; no runtime plugin loading without a decision note
-- **Two repositories**: `summercms.go` is the framework only (the `summer` packages, the CLI, the admin SPA shell, the parity harness tooling) and knows nothing about Płytarium; `fonoteka.go`, a sibling directory in the meta repo, is the application: a go.work workspace holding the ported plugins (user, websockets, translate, feedback, sitemap, fonoteka) and the app binary, requiring the framework by module path with a local replace during development. Roadmap phases name which repo each plan writes to; planning docs stay in `summercms.go/.planning`
+- **Two repositories**: `summercms.go` is the framework only (the `summer` packages, the CLI, the admin SPA shell, the parity harness tooling) and knows nothing about Płytarium; `fonoteka.go`, a sibling directory in the meta repo, is the application: a go.work workspace holding the ported plugins (user, translate, feedback, sitemap, fonoteka) and the app binary; websockets is not a separate app plugin (D-16, Phase 11): the framework realtime package `lighthouse` plus fonoteka's `config/realtime.yaml`, channel authorizers, `lighthouse.Mount` call and `ws-api` bucket replace it, requiring the framework by module path with a local replace during development. Roadmap phases name which repo each plan writes to; planning docs stay in `summercms.go/.planning`
 - **Workflow**: lean planning (few, large plans per phase), a plan-count checkpoint before PLAN.md files are written, unit tests as the last plan of every phase, `go vet` and `go test ./...` green at every commit
 - **Commits**: no co-author tags; one logical change per commit; planning docs and code in separate commits
 - **Core plugin contracts**: the PHP user, blog, pages and payment plugins are shared across many projects; the Go ports must preserve their contracts and the PHP originals are not changed as part of this project
@@ -159,6 +159,7 @@ Quality
 | swaggo/swag for OpenAPI, not Huma | Comment annotations on plain net/http handlers keep 154 ported routes byte-compatible; Huma would reshape every handler | — Pending |
 | GORM + River share one `*sql.DB` (pgx stdlib) with a separate pgx pool for LISTEN/NOTIFY | River's documented GORM integration; transactional enqueue inside GORM transactions | ✓ Good for the shared `*sql.DB` seam (Phase 3); River listener pool still Phase 11 |
 | Parity harness is a day-one workstream | Fixture recording needs only the running PHP backend; it is the acceptance mechanism for every port phase | ✓ Good (Phase 2, 2026-09-17: 154/154 PHP self-replay, Nuxt/MCP fixtures, testcontainers Go runner) |
+| WinterCMS websockets plugin dissolved into the framework `lighthouse` package (Phase 11 D-16) | Realtime is transport-neutral framework code (drivers, authorizer registry, broadcasts); the app only binds config, the collection/wishlist authorizers, the Mount call, the ws-api bucket and the Album binding, so a separate app plugin would be an empty shell | ✓ Good (Phase 11 plan 11-03) |
 | Framework and application in two repos from day one (`summercms.go`, `fonoteka.go`) | Retrofitting the split later is more disruptive; shared stack plugins can be extracted for keios.eu without touching the framework; the framework never imports an app | ✓ Good (Phase 3: fonoteka.go workspace, user + fonoteka plugins, app.Handler test seam) |
 
 ## Evolution

.planning/REQUIREMENTS.md

@@ -91,7 +91,7 @@ Requirements for v1 (the Płytarium port). Each maps to roadmap phases. "User" b
 
 ### Realtime (RT)
 
-- [ ] **RT-01**: The websockets plugin publishes to the existing Centrifugo server (gocent) and issues connection and subscription JWTs with the same secret and claims, served at GET /api/realtime/token
+- [ ] **RT-01**: The websockets plugin publishes to the existing Centrifugo server (gocent) and issues connection and subscription JWTs with the same secret and claims, served at GET /api/realtime/token. *Note (D-12, D-16): the Centrifugo client is a hand-rolled `net/http` client in the framework package `lighthouse/centrifugo` rather than the originally named gocent library, and the publisher lives in that framework package rather than an app websockets plugin.*
 - [ ] **RT-02**: A channel-namespace authorizer registry lets plugins register authorizers (collection, wishlist); the server re-validates on every subscribe and channel names never expose raw ids
 - [ ] **RT-03**: A broadcastable model interface emits live patches with bulk-write suppression, separate from durable notifications