docs(05): create gap closure plans for milestone audit findings

Phase 05: 2 gap closure plans in 1 wave
- 05-06: P0 tenant scoping fix (6 models) + CASL subject correction
- 05-07: E2E test coverage gaps + Phase 2 verification correction
- Both plans are parallel (Wave 1, no dependencies)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.planning/ROADMAP.md

@@ -16,7 +16,7 @@ Decimal phases appear between their surrounding integers in numeric order.
 - [x] **Phase 2: Subscriber and Billing Core** - Subscriber management, billing engine, payment recording, and the double-entry accounting ledger
 - [x] **Phase 3: Operational Modules** - Collector workflow, ticketing system, job orders, and technician management
 - [x] **Phase 4: Inventory, Expenses, and Financial Reports** - Inventory event-ledger, asset management, expense tracking, and accounting financial statements
-- [x] **Phase 5: Visibility and Client Portal** - Dashboard metrics, client self-service portal, integration tests, and end-to-end tests
+- [ ] **Phase 5: Visibility and Client Portal** - Dashboard metrics, client self-service portal, integration tests, and end-to-end tests (gap closure in progress)
 
 ## Phase Details
 
@@ -113,8 +113,8 @@ Plans:
   2. A subscriber can log in to the client portal and view their current bill, outstanding balance, payment history, and current plan details — scoped strictly to their own account at both the API and data layers
   3. A subscriber can submit a support ticket through the client portal and see it reflected in staff's ticket queue
   4. All API endpoints have integration tests that assert correct responses for authorized and unauthorized roles, verifying API-layer RBAC is not bypassed
-  5. Critical user workflows (subscriber registration → invoice generation → payment recording, collector collection → remittance verification, ticket creation → job order completion) pass end-to-end tests
-**Plans**: 5 plans
+  5. Critical user workflows (subscriber registration -> invoice generation -> payment recording, collector collection -> remittance verification, ticket creation -> job order completion) pass end-to-end tests
+**Plans**: 7 plans
 
 Plans:
 - [x] 05-01-PLAN.md — Dashboard service: revenue metrics, overdue counts, subscriber status breakdown, cash flow summary, collector summary (DASH-01, DASH-02, DASH-03, DASH-04)
@@ -122,18 +122,20 @@ Plans:
 - [x] 05-03-PLAN.md — Portal tickets and payment scaffold: ticket submission with conversation threads, online payment "coming soon" page (PORT-03, PORT-05)
 - [x] 05-04-PLAN.md — Integration tests: API RBAC enforcement for all 5 roles, unauthorized access assertions, two-tenant isolation tests (INFRA-03)
 - [x] 05-05-PLAN.md — End-to-end tests: billing workflow, collection/remittance workflow, ticket-to-job-order workflow (INFRA-04)
+- [ ] 05-06-PLAN.md — Gap closure: fix tenant scoping for 6 missing models, add Collection/Remittance CASL subjects (P0 security + tech debt)
+- [ ] 05-07-PLAN.md — Gap closure: inventory/expense and portal ticket E2E tests, Phase 2 verification correction (tech debt)
 
 ---
 
 ## Progress
 
 **Execution Order:**
-Phases execute in numeric order: 1 → 2 → 3 → 4 → 5
+Phases execute in numeric order: 1 -> 2 -> 3 -> 4 -> 5
 
 | Phase | Plans Complete | Status | Completed |
 |-------|----------------|--------|-----------|
-| 1. Foundation | 5/5 | ✓ Complete | 2026-03-04 |
-| 2. Subscriber and Billing Core | 5/5 | ✓ Complete | 2026-03-04 |
-| 3. Operational Modules | 5/5 | ✓ Complete | 2026-03-05 |
-| 4. Inventory, Expenses, and Financial Reports | 5/5 | ✓ Complete | 2026-03-06 |
-| 5. Visibility and Client Portal | 5/5 | ✓ Complete | 2026-03-05 |
+| 1. Foundation | 5/5 | Complete | 2026-03-04 |
+| 2. Subscriber and Billing Core | 5/5 | Complete | 2026-03-04 |
+| 3. Operational Modules | 5/5 | Complete | 2026-03-05 |
+| 4. Inventory, Expenses, and Financial Reports | 5/5 | Complete | 2026-03-06 |
+| 5. Visibility and Client Portal | 5/7 | Gap Closure | 2026-03-05 |