docs(16-04): complete gitleaks+dockerignore plan — add SUMMARY, advance state

.planning/STATE.md

@@ -4,13 +4,13 @@ milestone: v1.1
 milestone_name: Operability & Polish
 status: executing
 stopped_at: Completed 16-03-PLAN.md
-last_updated: "2026-06-13T09:26:02.327Z"
+last_updated: "2026-06-13T12:16:33.687Z"
 last_activity: 2026-06-13 -- Phase 16 execution started
 progress:
   total_phases: 19
   completed_phases: 6
   total_plans: 23
-  completed_plans: 20
+  completed_plans: 21
   percent: 32
 ---
 
@@ -26,7 +26,7 @@ See: .planning/PROJECT.md (updated 2026-06-10)
 ## Current Position
 
 Phase: 16 (ci-dependency-audit-and-security-checks) — EXECUTING
-Plan: 4 of 6
+Plan: 5 of 6
 Status: Ready to execute
 Last activity: 2026-06-13 -- Phase 16 execution started
 
@@ -106,6 +106,7 @@ _Updated after each plan completion_
 | Phase 16 P01 | 188 | 3 tasks | 4 files |
 | Phase 16-ci-dependency-audit-and-security-checks P02 | 25 | 3 tasks | 5 files |
 | Phase 16-ci-dependency-audit-and-security-checks P03 | 2 | 2 tasks | 5 files |
+| Phase 16 P04 | 45 | 4 tasks | 3 files |
 
 ## Accumulated Context
 
@@ -171,6 +172,8 @@ Recent decisions affecting current work:
 - [Phase ?]: D-08 (16-01): assertNotDevBypassInProduction() boot guard — first statement in isMainModule(), exits non-zero when NODE_ENV=production AND DEV_AUTH_BYPASS=true; unit-tested
 - [Phase ?]: D-03-SEC-VERSION: Pinned eslint-plugin-security@3.0.1 over 4.0.1 — stable, flat-config compatible with ESLint 9.39.4, more bake time
 - [Phase ?]: D-03-OBJ-INJECT: detect-object-injection disabled globally in eslint-plugin-security block — all hits were numeric loop indices / schema-derived keys; zod guards real API input; 14 of 15 rules remain at error
+- [Phase ?]: D-04-ALLOWLIST: crypto.test.ts TEST_KEY allowlisted by path — human-verified Vitest beforeAll synthetic AES-256-GCM fixture; 4th [[allowlists]] block in .gitleaks.toml
+- [Phase ?]: D-04-BASELINE: gitleaks full-history baseline is empty [] after allowlisting — 613 commits / 23 MB scanned clean; PR-diff scans in 16-05 start from provably clean state
 
 ### Roadmap Evolution
 
@@ -235,7 +238,7 @@ Recent decisions affecting current work:
 
 ## Session Continuity
 
-Last session: 2026-06-13T09:26:02.314Z
+Last session: 2026-06-13T12:16:33.678Z
 Stopped at: Completed 16-03-PLAN.md
 Resume file: None