docs(roadmap): rewrite README roadmap to reflect actual state

The original table marked Phase 1 as "next" but Phases 1-5a have
all shipped. Replaces the single table with three sections:
Shipped (now includes RBAC, rooms/floors/accounts/expenses, the
sub-property hierarchy, and the fnm/pnpm tooling switch — none of
which were on the original roadmap), 5b-pending (reports,
cross-app APIs to budget/repair), and a Phase 6 quality-of-life
backlog covering maintenance-reminder cron, OIDC handlers,
self-service password reset, permission inheritance, bulk CSV
property import, audit log viewer, and project↔property linking.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -161,14 +161,38 @@ static/                          public static assets (drop favicon here)
 
 ## Roadmap
 
-| Phase | Scope | State |
-| --- | --- | --- |
-| 0 | Scaffold: stack wiring + auth + layout shell + storage interface + tenancy schema + git remote | ✅ shipped |
-| 1 | Properties + Assets with typed custom fields + mobility history + asset logs + document upload per scope | next |
-| 2 | Checklist templates + maintenance schedules (time + usage) + maintenance events + usage readings | |
-| 3 | Projects + WorkPackages → Tasks → Subtasks + **structured decision events** (title, body, alternatives, cost_impact, approved_by, tags) | |
-| 4 | Wiki (global + project + property) with EasyMDE + revisions + FTS | |
-| 5 *(later)* | QR label generation, email/in-app notifications, reports, S3 storage adapter, cross-app APIs | |
+### Shipped
+
+| Phase | Scope |
+| --- | --- |
+| 0 | Scaffold: stack wiring + auth + layout shell + storage interface + tenancy schema + git remote |
+| 1 | Properties + Assets with typed custom fields + mobility history + asset logs + document upload per scope |
+| 2 | Checklist templates + maintenance schedules (time + usage) + maintenance events + usage readings |
+| 3 | Projects + WorkPackages → Tasks → Subtasks + structured decision events (title, body, alternatives, cost_impact, approved_by, tags) |
+| 4 | Wiki (global + project + property) with EasyMDE + revisions + FTS |
+| 5a | QR label generation, in-app + email + Matrix notifications, S3 storage adapter |
+| — | RBAC: user/company admin, role middleware, last-admin guards |
+| — | Property structure: rooms + floors, utility account/meter records, expenses with CSV import + electricity/water chart |
+| — | Sub-property hierarchy: parent_id self-FK, recursive-CTE descendant rollups, "Include sub-properties" toggle on Expenses/Assets/Maintenance/Todos tabs, depth-first nested list view, depth-cap warning at 5 levels |
+| — | Tooling: switched to fnm + pnpm, Gitea CI deploy workflow with public-HTTPS clone, full `DEPLOYMENT.md` |
+
+### 5b — pending Phase 5 items
+
+- **Reports** — cross-cutting outputs (monthly building roll-up, annual asset summary). Per-domain CSV exports already exist; this is the aggregated/scheduled layer
+- **Cross-app APIs** — wire `buildfor_life_ops` to siblings `buildfor_life_budget` and `buildfor_life_repair` so decisions can link to budget line items and repair tickets
+
+### 6 — quality-of-life backlog
+
+Things that came up after the original roadmap was written. Not prioritised — pull whichever the next stakeholder ask depends on.
+
+- **Maintenance reminders** — cron-style trigger that fires `maintenance_event_recorded` / `task_assigned` notifications when `next_due_at` crosses a threshold. The notification fan-out (app + email + Matrix) is already there; only the scheduler is missing
+- **OIDC SSO** — env vars + schema are wired (`OIDC_ENABLED`, `OIDC_ISSUER`, etc.), but the route handlers were never written
+- **Self-service password reset** — currently admin-initiated only via `pnpm run create-user`
+- **Permission inheritance for sub-properties** — RBAC is per-company today; "manager of Building A" does not imply "manager of Apt 3B"
+- **Bulk property CSV import** — "create N apartments under this building" in one upload, mirroring the existing expenses CSV importer
+- **"Move to parent" quick action** — UI sugar over the existing edit form for re-parenting
+- **Audit log viewer** — `audit_action` enum + audit infrastructure exists, but no UI to browse it
+- **Project ↔ property linking** — they're disjoint today; many real workflows want "this project is happening at this property"
 
 ## Key design decisions