docs(06): create phase 6 plan — performance & production hardening

6 plans across 4 waves covering structlog/Loki observability, Locust
load testing, multi-stage Dockerfile hardening, trusted-proxy rate
limiting, and RUNBOOK.md. Verification passed (0 blockers).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.planning/ROADMAP.md

@@ -286,7 +286,32 @@ Before any phase is marked complete, all three gates must pass:
 4. Container hardening is complete: non-root user, read-only root filesystem, dropped Linux capabilities; `docker scout` or equivalent reports zero critical CVEs
 5. A runbook documents all environment variables, startup/shutdown procedures, backup strategy, and on-call escalation path; the app can be stood up from scratch using only the runbook
 
-**Plans**: TBD
+**Plans**: 6 plans (4 waves)
+
+**Wave 0** — Test scaffolds + package verification
+
+- [ ] 06-01-PLAN.md — Nyquist Wave 0: xfail stubs (test_logging.py, test_rate_limiting.py), Locust skeleton, package legitimacy checkpoint (D-01, D-04, D-11, D-12)
+
+**Wave 1** *(blocked on Wave 0 completion)*
+
+- [ ] 06-02-PLAN.md — structlog JSON logging + CorrelationIDMiddleware + Loki/Promtail/Grafana Docker Compose stack (D-01, D-02, D-03)
+- [ ] 06-03-PLAN.md — Locust locustfile.py with JWT auth + SLA gate listener (D-04, D-05, D-06)
+
+**Wave 2** *(blocked on Wave 1 completion)*
+
+- [ ] 06-04-PLAN.md — Multi-stage Dockerfile + read_only/tmpfs/cap_drop on backend + celery-worker (D-07, D-08, D-09)
+- [ ] 06-05-PLAN.md — Trusted-proxy get_client_ip body + per-account rate limiter on document/cloud endpoints (D-11, D-12, D-13)
+
+**Wave 3** *(blocked on Wave 2 completion)*
+
+- [ ] 06-06-PLAN.md — docker scout CVE gate + RUNBOOK.md (D-10, D-14)
+
+**Cross-cutting constraints:**
+
+- get_client_ip lives ONLY in backend/deps/utils.py — replace body in-place, no new function (Plans 05)
+- celery-beat intentionally excluded from read_only: true (Plan 04)
+- locust must NOT be in requirements.txt — use requirements-dev.txt (Plan 03)
+- CorrelationIDMiddleware registered LAST in main.py — Starlette reverse order (Plan 02)
 
 ---
 
@@ -358,6 +383,16 @@ Before any phase is marked complete, all three gates must pass:
 
 **Status: ✓ Complete (2026-06-01)**
 
+### Phase 7: Redo and optimize LLM integration
+
+**Goal:** [To be planned]
+**Requirements**: TBD
+**Depends on:** Phase 6
+**Plans:** 0 plans
+
+Plans:
+- [ ] TBD (run /gsd-plan-phase 7 to break down)
+
 ---
 
 ## Progress Table