docs(roadmap): mark #3375 done; #3454 is Pro-only, note design constraint

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ROADMAP.md

@@ -136,7 +136,8 @@ Order = user-visible value first; each ships with backend + UI + tests.
 ## 5. Phase C — security + quality
 
 - Own security review on top of upstream fixes: session/token entropy audit, SSRF guard re-test (NAT64 class), rate limiting on auth endpoints
-- Fix upstream bug backlog by impact: #3574 OOM (trash_bin_collect streaming), #3118/#3005 WebDAV large-file, #3454 PG FK, #3375 SMTP auth discovery
+- Fix upstream bug backlog by impact: #3574 OOM (trash_bin_collect streaming), #3118/#3005 WebDAV large-file, ~~#3375 SMTP auth discovery~~ (done — `smtp_auth` setting)
+- #3454 (PG FK on upload) is **Pro-only** — `audit_logs` doesn't exist in this codebase. When B.5 adds our own audit log: insert the audit row in the same tx *after* the file row, never before.
 - `desloppify` + `security-reviewer` passes; scorecard appended to README
 
 ## 6. Phase D — desktop, all platforms