docs: mark all of Wave 5 done (fan-out, access token, android parity)

docs/ROADMAP.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-> **Status (2026-07-13):** Wave 1-4 (all 8 items) implemented + committed on `develop` — see docs/PROGRESS_LOG.md for the per-feature commits. Remaining: Wave 5 (fan-out board, access token, Android parity) + the deferred backlog.
+> **Status (2026-07-13):** ALL of Wave 1-5 (11 items) implemented + committed on `develop` — see docs/PROGRESS_LOG.md for per-feature commits. Remaining: only the deferred backlog table (smaller, several now cheap on the shipped PTY-inject + approval-preview primitives).
 
 Prioritized backlog of features to build next, derived from a grounded analysis of
 the codebase + the existing planning docs (5 exploration lenses → 24 candidates →
@@ -115,7 +115,7 @@ build sequence (dependencies noted).
 
 ## Wave 5 — bigger bets
 
-- [ ] **Worktree fan-out board** _(the north star: 真并行不互踩)_
+- [x] **Worktree fan-out board** _(the north star: 真并行不互踩)_
   Fan one task across N branch/agent lanes of one repo, watch them race, approve/kill per lane,
   keep the winner. **Mostly composition of shipped parts** — `createWorktree` + live-sessions +
   the split-grid watch board + statusLine gauges + per-quadrant inline approve; server side is a
@@ -131,7 +131,7 @@ build sequence (dependencies noted).
   **Honest tradeoff:** a bar-raiser, **not** a TLS/Tailscale substitute — on bare `ws://` the
   token is cleartext and replayable; only hardens the TLS-terminated relay/tunnel path. **Effort: M.**
 
-- [ ] **Android Projects / Diff / Worktree screens** (client parity)
+- [x] **Android Projects / Diff / Worktree screens** (client parity)
   Android's whole v0.6/v0.7 projects-git UI is SDK-gated/off in `settings.gradle.kts`.
   Zero server change (the `:api-client` module already speaks the endpoints), but the largest
   scope. Sequence *after* the server-side git features so it's one parity pass. **Effort: L.**