Complete Phase 10: authorization matrix, stale push cleanup, and retention-default tests

- Add authorization.integration.test.ts covering unauthenticated/regular-user/admin
  access across both admin-only and merely-authenticated routes
- Add stale push subscription cleanup test (disableSubscription excludes a device
  from fan-out without deleting its row/history)
- Add retention test for a topic with no override falling back to the resolved
  Admin-configured global default
- Update README status: Phases 2-10 complete

README.md

@@ -16,11 +16,15 @@ it, and it's a general-purpose tool built for a much broader audience than
 something purpose-fit for this specific use case, entirely self-hosted,
 with no data ever leaving the LAN except the push notification itself.
 
-Status: **Phases 2–9 complete**, Phase 10 (hardening/test-gap-filling) in
-progress. Auth, topics, notification ingestion (canonical + ntfy-compat +
-webhook), rate limiting, dedup, SSE live updates, retention cleanup, the
-full user-facing UI, Web Push, and the admin UI are all built and verified
-against a live dev stack. See
+Status: **Phases 2–10 complete**. Auth, topics, notification ingestion
+(canonical + ntfy-compat + webhook), rate limiting, dedup, SSE live
+updates, retention cleanup, the full user-facing UI, Web Push, and the
+admin UI are all built and verified against a live dev stack. Phase 10's
+specific test gaps (authorization matrix across roles, stale push
+subscription cleanup, retention's global-default fallback) are covered by
+the automated suite (`pnpm test`), and the dependency/CSP/HSTS security
+pass is done — see [Backup and restore](#backup-and-restore) and the
+troubleshooting entries below for the operational side. See
 [docs/phase1/08-implementation-plan.md](docs/phase1/08-implementation-plan.md)
 for the phase breakdown and [MVP acceptance status](#mvp-acceptance-status)
 below for where things stand against the original 22 criteria.