docs(01-data-integrity): create phase 1 plans

.planning/ROADMAP.md

@@ -28,7 +28,11 @@ Decimal phases appear between their surrounding integers in numeric order.
   2. Deleting a tag removes all associated tag assignments (foreign key cascade enforced)
   3. An oversized webhook payload is rejected with a 413 response, not processed silently
   4. A failing assertion in a test causes the test run to report failure, not pass silently
-**Plans**: TBD
+**Plans**: 2 plans
+
+Plans:
+- [ ] 01-01-PLAN.md — Fix INSERT OR REPLACE → UPSERT in UpdateEvent(); enable PRAGMA foreign_keys = ON in InitDB(); add regression test
+- [ ] 01-02-PLAN.md — Add http.MaxBytesReader body limits to 3 handlers (413 on oversized); replace 6 silent test returns with t.Fatalf
 
 ### Phase 2: Backend Refactor
 **Goal**: The codebase has a clean Store interface and Server struct so the SQLite implementation can be swapped without touching HTTP handlers, enabling parallel test execution and PostgreSQL support
@@ -74,7 +78,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4
 
 | Phase | Plans Complete | Status | Completed |
 |-------|----------------|--------|-----------|
-| 1. Data Integrity | 0/? | Not started | - |
+| 1. Data Integrity | 0/2 | Not started | - |
 | 2. Backend Refactor | 0/? | Not started | - |
 | 3. PostgreSQL Support | 0/? | Not started | - |
 | 4. UX Improvements | 0/? | Not started | - |