docs(10-02): complete admin-role-primitives plan summary and state update

.planning/ROADMAP.md

@@ -177,7 +177,7 @@ Plans:
 
 **Wave 2** *(blocked on Wave 1 completion)*
 
-- [ ] 10-02-PLAN.md — requireAdmin guard + first-login-wins bootstrap + /api/me isAdmin/needsProviderSetup (TDD)
+- [x] 10-02-PLAN.md — requireAdmin guard + first-login-wins bootstrap + /api/me isAdmin/needsProviderSetup (TDD)
 
 **Wave 3** *(blocked on Wave 2 completion)*
 
@@ -369,7 +369,7 @@ Plans:
 | 7. Mobile Test Harness           | v1.1 | 4/4 | Complete    | 2026-06-11 |
 | 8. Gitea CI                      | v1.1 | 4/4 | Complete   | 2026-06-11 |
 | 9. Faster Write-Back             | v1.1 | 2/2 | Complete    | 2026-06-12 |
-| 10. Admin Role & Settings        | v1.1 | 1/4 | In Progress|  |
+| 10. Admin Role & Settings        | v1.1 | 2/4 | In Progress|  |
 | 11. Per-Event Reminders          | v1.1 | 0/?   | Not started | -       |
 | 12. Initial Setup Wizard         | v1.1 | 0/?   | Not started | -       |
 | 13. Real Lint Gate (ESLint)      | v1.1 | 3/3   | Complete    | 2026-06-12 |
@@ -383,7 +383,7 @@ Plans:
 
 **Goal:** [Captured for future planning] Abstract the calendar backend behind a provider interface so Fastmail/CalDAV is one implementation among potentially many. Shipping with a single provider is fine, but the broker, sync, and event-expansion layers should be structured so additional providers (e.g. other CalDAV hosts, Google Calendar, generic ICS feeds) can be added without rework. Captures the "provider" seam as an explicit architectural concern.
 **Requirements:** TBD
-**Plans:** 1/4 plans executed
+**Plans:** 2/4 plans executed
 
 Plans: