docs(09): phase 9 planning complete — 3 plans in 2 waves (schema + admin builder + public quote page)

Phase 9 breaks into two parts:
- Wave 0: Schema foundation (Phase 8) — offer_phases, quotes, quote_items tables + type system
- Wave 1: Admin Quote Builder (/admin/quotes/new) — form, server action, price validation
- Wave 2: Public Quote Page (/quote/[token]) — multistep form, acceptance, rate limiting

Plans:
- 09-01: Database schema (offer_phases, quotes, quote_items) + Drizzle migration + query layer types
- 09-02: Admin builder UI (two-column form, client/offer selection, live preview) + createQuote action
- 09-03: Public quote page (token-gated route, middleware rate limit 3/min, multistep wizard, acceptQuote action)

Key constraints per CLAUDE.md:
- quote_items NEVER exposed to client API (public query layer enforces PublicQuoteView type)
- Server-side price recalculation prevents tampering (client-side total validated against item sum)
- Immutability enforced: accepted_at timestamp immutable once set (DB constraint + app check)
- Token: nanoid 21-char (~122-bit entropy), unique, rate-limited at middleware

Estimated execution: 4-5 days. Wave 0 can run in parallel with Wave 1 (no blocking).

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

.planning/ROADMAP.md

@@ -194,10 +194,15 @@ Decimal phases appear between their surrounding integers in numeric order.
   3. Accept CTA → `/api/public/quote/accept?token=X` con cattura email + note
   4. Token: nanoid 21 char, unico, rate limit 3 views/min per IP
   5. Mai esporre `quote_items` (prezzi per servizio) via public API
-**Plans**: 3 (quote builder + public routes + security)
+**Plans**: 3 plans in 2 waves
+**Plan list**:
+  - [ ] 09-01-PLAN.md — Phase 8 Foundation: schema (offer_phases, quotes, quote_items) + types + validators
+  - [ ] 09-02-PLAN.md — Admin Quote Builder: /admin/quotes/new form + createQuote action + two-column preview
+  - [ ] 09-03-PLAN.md — Public Quote Page: /quote/[token] multistep form + acceptQuote + rate limiting
 **Durata**: 4–5 giorni
-**Status**: Pending planning
-**Risk**: RHF + React 19 compatibility (dev test prima del merge); PDF generation approach TBD
+**Status**: ✅ Planning complete
+**Risk**: RHF + React 19 compatibility (dev test prima del merge); in-memory rate limit resets on cold start (OK for MVP, upgrade to Upstash Redis in Phase 10+)
+
 
 ### Phase 10: CRM Pipeline & Activity Logging
 **Goal**: Lead CRUD, activity log, follow-up reminders, quote assignment; pipeline stages