docs: track cross-plan follow-ups (Secure cookie, encryption at rest, env parsing)

docs/superpowers/followups.md

@@ -0,0 +1,13 @@
+# Cross-Plan Follow-ups
+
+Items surfaced during review of one plan that belong to a later plan. Prevents silent drops.
+
+## Deferred to Plan 4 (Container + Coolify deploy)
+
+- **Forwarded-headers + Secure-cookie behind Traefik.** Cookie auth in Task 5 uses the ASP.NET Core default `CookieSecurePolicy.SameAsRequest`. Behind Coolify/Traefik TLS termination the app sees plain HTTP internally, so the cookie will silently be sent WITHOUT the `Secure` flag in production unless `UseForwardedHeaders` (with `ForwardedHeaders.XForwardedProto`) is added and TLS-terminating proxies are configured as `KnownProxies`/`KnownNetworks`. Wire this up when we add the Dockerfile + compose in Plan 4.
+
+## Deferred to Plan 2 (Executor + real nodes)
+
+- **Encryption at rest for `admin_config`.** The `PasswordSourceKey` row currently stores the plaintext ADMIN_PASSWORD (documented trade-off in `AdminBootstrap.cs`). When Plan 2 introduces AES-GCM for `connections.config_json_encrypted`, extend the encryption to the sensitive `admin_config` values.
+- **`AdminConfigRepository` direct unit tests.** Currently exercised only through `AdminBootstrapTests`. Add a small Get/Set/UPSERT round-trip test.
+- **Fail-fast integer parsing** in the `Program.cs` env-var loop. Malformed values (`EXECUTION_RETENTION_DAYS=abc`) currently blow up opaquely inside `Configuration.Bind`. Add `int.TryParse` with a clear "env var X has non-integer value" message.