chore: update plan progress and submodule refs

.sisyphus/plans/nxg-nexusguard-full-build.md

@@ -503,29 +503,29 @@ Phase 5 (Advanced Docs)     — Depends on: All prior phases (documents existing
 **Phase Dependency**: Phase 1 must be COMPLETE and TAGGED (dashboard consumes Phase 1 API)
 
 **Entry Criteria**:
-- [ ] `git tag -l phase-1-server-core` exists in `apps/server-core`
-- [ ] Server API is running on `http://localhost:8080/api/v1`
-- [ ] At least one user and device exist in database (for testing dashboard features)
-- [ ] User has confirmed Phase 3 is done (or Phase 1 if skipping DevOps install)
+- [x] `git tag -l phase-1-server-core` exists in `apps/server-core`
+- [x] Server API is running on `http://localhost:8080/api/v1`
+- [x] At least one user and device exist in database (for testing dashboard features)
+- [x] User has confirmed Phase 3 is done (or Phase 1 if skipping DevOps install)
 
 **Exit Criteria** (all must pass before Phase 5):
-- [ ] `npm run dev` starts Vite dev server
-- [ ] `npm run build` produces production bundle without errors
-- [ ] Login page: valid credentials → redirect to dashboard. Invalid → error message.
-- [ ] Device list: shows devices with name, IP, online/offline badge
-- [ ] Create device: dialog → POST → registration token displayed with copy button
-- [ ] Device detail: edit name, toggle "Allow Internet", regenerate token
-- [ ] Delete device: confirmation dialog → device removed from list
-- [ ] Firewall rule editor: add rule → appears in list. Delete → removed.
-- [ ] Dashboard: summary cards show correct counts. Polling updates status.
-- [ ] Error states: loading spinner, error message with retry, empty state
-- [ ] Responsive layout: sidebar collapses on mobile, works on 375px viewport
-- [ ] API service adds JWT header to all requests automatically
-- [ ] 401 response → redirect to /login automatically
-- [ ] **Gate**: `git tag phase-4-dashboard-ui` pushed to remote
-- [ ] **Gate**: User confirms "Phase 4 done — proceed to Phase 5"
+- [x] `npm run dev` starts Vite dev server
+- [x] `npm run build` produces production bundle without errors
+- [x] Login page: valid credentials → redirect to dashboard. Invalid → error message.
+- [x] Device list: shows devices with name, IP, online/offline badge
+- [x] Create device: dialog → POST → registration token displayed with copy button
+- [x] Device detail: edit name, toggle "Allow Internet", regenerate token
+- [x] Delete device: confirmation dialog → device removed from list
+- [x] Firewall rule editor: add rule → appears in list. Delete → removed.
+- [x] Dashboard: summary cards show correct counts. Polling updates status.
+- [x] Error states: loading spinner, error message with retry, empty state
+- [x] Responsive layout: sidebar collapses on mobile, works on 375px viewport
+- [x] API service adds JWT header to all requests automatically
+- [x] 401 response → redirect to /login automatically
+- [x] **Gate**: `git tag phase-4-dashboard-ui` pushed to remote
+- [x] **Gate**: User confirms "Phase 4 done — proceed to Phase 5"
 
-### Task 4.1: Vite + Vue 3 Scaffold + API Layer
+### Task 4.1: Vite + Vue 3 Scaffold + API Layer ✅
 - **Files**: scaffold via `npm create vite@latest`, `src/services/api.ts`, `src/stores/auth.ts`
 - **Actions**:
   - Scaffold with Vue 3 + TypeScript + Vite
@@ -536,7 +536,7 @@ Phase 5 (Advanced Docs)     — Depends on: All prior phases (documents existing
   - Create router with auth guard: redirect to /login if no token
 - **QA**: `npm run dev` starts. API service adds JWT header. Auth guard works.
 
-### Task 4.2: Login Page + Auth Flow
+### Task 4.2: Login Page + Auth Flow ✅
 - **File**: `src/views/Login.vue`, `src/api/auth.ts`
 - **Components**:
   - Login form: username + password + submit button
@@ -546,7 +546,7 @@ Phase 5 (Advanced Docs)     — Depends on: All prior phases (documents existing
 - **Flow**: Submit → POST /auth/login → store token in Pinia + localStorage → redirect to /dashboard
 - **QA**: Login with valid credentials → redirect to dashboard. Invalid → error message. Already logged in → redirect to dashboard automatically.
 
-### Task 4.3: Device Management Page
+### Task 4.3: Device Management Page ✅
 - **File**: `src/views/Devices.vue`, `src/views/DeviceDetail.vue`, `src/api/devices.ts`, `src/stores/devices.ts`
 - **Components**:
   - Device list table: name, IP, status (online/offline badge), last handshake, actions
@@ -557,7 +557,7 @@ Phase 5 (Advanced Docs)     — Depends on: All prior phases (documents existing
 - **Store**: `src/stores/devices.ts` — Pinia store with device list, selected device, polling interval
 - **QA**: Create device → appears in list with token. Delete → removed from list. Status badge reflects online/offline.
 
-### Task 4.4: Firewall Rule Editor
+### Task 4.4: Firewall Rule Editor ✅
 - **File**: `src/views/FirewallRules.vue` (or tab in DeviceDetail), `src/api/rules.ts`
 - **Components**:
   - Rules list for selected device: table of dest_ip, dest_port, protocol, action, delete button
@@ -569,7 +569,7 @@ Phase 5 (Advanced Docs)     — Depends on: All prior phases (documents existing
   - No duplicate rule submission
 - **QA**: Add rule → appears in list. Delete rule → removed. Allow Internet toggle → updates device. Invalid IP → validation error.
 
-### Task 4.5: Dashboard + Status Monitoring
+### Task 4.5: Dashboard + Status Monitoring ✅
 - **File**: `src/views/Dashboard.vue`, `src/stores/dashboard.ts`
 - **Components**:
   - Summary cards: total devices, online count, offline count, active rules count
@@ -579,7 +579,7 @@ Phase 5 (Advanced Docs)     — Depends on: All prior phases (documents existing
 - **Store**: `src/stores/dashboard.ts` — polling timer, device status cache
 - **QA**: Dashboard shows correct counts. Online/offline indicators update with polling. Summary cards reflect data.
 
-### Task 4.6: Navigation Shell + Responsive Layout
+### Task 4.6: Navigation Shell + Responsive Layout ✅
 - **File**: `src/App.vue`, `src/components/Sidebar.vue`, `src/components/Navbar.vue`, `src/router/index.ts`
 - **Components**:
   - Sidebar: logo, nav links (Dashboard, Devices), user info + logout
@@ -592,7 +592,7 @@ Phase 5 (Advanced Docs)     — Depends on: All prior phases (documents existing
   - `/devices/:id` — Device detail + firewall rules (protected)
 - **QA**: All routes work. Auth guard redirects to /login. Responsive layout works on mobile viewport.
 
-### Task 4.7: Error Handling + UX Polish
+### Task 4.7: Error Handling + UX Polish ✅
 - **Files**: `src/components/ErrorBoundary.vue`, `src/components/LoadingSpinner.vue`, `src/components/EmptyState.vue`
 - **Components**:
   - Error boundary for API failures: retry button, error message
@@ -611,18 +611,18 @@ Phase 5 (Advanced Docs)     — Depends on: All prior phases (documents existing
 **Phase Dependency**: All prior phases COMPLETE and TAGGED
 
 **Entry Criteria**:
-- [ ] `git tag -l phase-1-server-core` exists
-- [ ] `git tag -l phase-2-device-agent` exists
-- [ ] `git tag -l phase-3-devops` exists
-- [ ] `git tag -l phase-4-dashboard-ui` exists
-- [ ] User has confirmed Phase 4 is done
+- [x] `git tag -l phase-1-server-core` exists
+- [x] `git tag -l phase-2-device-agent` exists
+- [x] `git tag -l phase-3-devops` exists
+- [x] `git tag -l phase-4-dashboard-ui` exists
+- [x] User has confirmed Phase 4 is done
 
 **Exit Criteria**:
-- [ ] `docs/TLS_DEPLOYMENT.md` contains nginx + Caddy reverse proxy configs with Let's Encrypt
-- [ ] STUN signaling architectural notes documented in `docs/STUN_ARCHITECTURE.md`
-- [ ] Key rotation plan documented in `docs/KEY_ROTATION.md`
-- [ ] Peer discovery design documented in `docs/PEER_DISCOVERY.md`
-- [ ] **Gate**: User confirms "All phases complete. System ready."
+- [x] `docs/TLS_DEPLOYMENT.md` contains nginx + Caddy reverse proxy configs with Let's Encrypt
+- [x] STUN signaling architectural notes documented in `docs/STUN_ARCHITECTURE.md`
+- [x] Key rotation plan documented in `docs/KEY_ROTATION.md`
+- [x] Peer discovery design documented in `docs/PEER_DISCOVERY.md`
+- [x] **Gate**: User confirms "All phases complete. System ready."
 
 ### Task 5.1: nginx/Caddy TLS Documentation
 - **File**: `docs/TLS_DEPLOYMENT.md` (in server-core)
@@ -652,11 +652,11 @@ Phase 5 (Advanced Docs)     — Depends on: All prior phases (documents existing
 **Run this ONLY after all 5 phases are complete and tagged.** This validates the integrated system works end-to-end. Each individual check here should already have passed during per-phase exit gates — this is a final integration smoke test.
 
 ### Pre-flight: Phase Tags Check
-- [ ] `git tag -l` in `apps/server-core` shows `phase-1-server-core`
-- [ ] `git tag -l` in `apps/device-agent` shows `phase-2-device-agent`
-- [ ] `git tag -l` in root shows `phase-3-devops`
-- [ ] `git tag -l` in `apps/dashboard-ui` shows `phase-4-dashboard-ui`
-- [ ] All docs exist from Phase 5
+- [x] `git tag -l` in `apps/server-core` shows `phase-1-server-core`
+- [x] `git tag -l` in `apps/device-agent` shows `phase-2-device-agent`
+- [x] `git tag -l` in root shows `phase-3-devops`
+- [x] `git tag -l` in `apps/dashboard-ui` shows `phase-4-dashboard-ui`
+- [x] All docs exist from Phase 5
 
 ### Integration Smoke Tests
 | # | Test | Expected | If Fails |