docs(11): add code review report

.planning/phases/11-individual-planning/11-REVIEW.md

@@ -0,0 +1,50 @@
+---
+phase: 11-individual-planning
+status: clean
+depth: standard
+files_reviewed: 15
+findings:
+  critical: 0
+  warning: 0
+  info: 0
+  total: 0
+reviewed: 2026-05-16
+---
+
+# Phase 11 Code Review
+
+## Scope
+
+Reviewed the Phase 11 source diff:
+
+- `backend/cmd/web/main.go`
+- `backend/internal/web/csrf_test.go`
+- `backend/internal/web/handlers_auth_test.go`
+- `backend/internal/web/handlers_etapes_test.go`
+- `backend/internal/web/handlers_events_test.go`
+- `backend/internal/web/handlers_files_test.go`
+- `backend/internal/web/handlers_planning.go`
+- `backend/internal/web/handlers_planning_test.go`
+- `backend/internal/web/handlers_social_test.go`
+- `backend/internal/web/handlers_tablos_test.go`
+- `backend/internal/web/handlers_tasks_test.go`
+- `backend/internal/web/handlers_test.go`
+- `backend/internal/web/router.go`
+- `backend/templates/planning.templ`
+- `backend/templates/planning_forms.go`
+
+## Findings
+
+No critical, warning, or info findings.
+
+## Review Notes
+
+- `/planning` is mounted inside the existing `auth.RequireAuth` route group, so unauthenticated access follows the established redirect behavior.
+- `PlanningPageHandler` queries through `ListUserEventsRange`, which joins through `tablos.user_id` and preserves owned-only filtering.
+- Date parsing falls back to local today for blank or invalid input and uses an inclusive 14-day window.
+- Event row rendering uses templ-escaped text and the existing validated tablo color pattern.
+- Regression coverage exercises auth, default range, chronological ordering, ownership isolation, navigation, empty state, invalid start fallback, source links, and the UAT date-label fix.
+
+## Residual Risk
+
+Browser layout polish remains dependent on manual UAT because the repo does not have screenshot or visual regression coverage for templ pages.