docs(18-02): complete REST API + SSE hub plan

- 18-02-SUMMARY.md with 2 task commits
- STATE.md updated with position and decisions
- Requirements WEB-03, WEB-09, WEB-11 marked complete

.planning/STATE.md

@@ -3,8 +3,8 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: Completed 17-04-PLAN.md
-last_updated: "2026-04-06T14:50:49.687Z"
+stopped_at: Completed 18-02-PLAN.md
+last_updated: "2026-04-06T15:07:44.687Z"
 last_activity: 2026-04-06
 progress:
   total_phases: 18
@@ -102,6 +102,7 @@ Progress: [██░░░░░░░░] 20%
 | Phase 16 P01 | 4min | 2 tasks | 6 files |
 | Phase 17 P01 | 3min | 2 tasks | 4 files |
 | Phase 17 P04 | 3min | 2 tasks | 4 files |
+| Phase 18 P02 | 7min | 2 tasks | 7 files |
 
 ## Accumulated Context
 
@@ -156,6 +157,9 @@ Recent decisions affecting current work:
 - [Phase 16]: URLhaus tag lookup with payload endpoint fallback
 - [Phase 17]: telego v1.8.0 promoted from indirect to direct; context cancellation for graceful shutdown; rate limit 60s scan/verify/recon, 5s others
 - [Phase 17]: Separated format from send for testable notifications without telego mock
+- [Phase 18]: JSON wrapper structs (apiKey, apiProvider, apiDork) with explicit JSON tags since domain structs only have yaml tags
+- [Phase 18]: API never exposes raw key values -- KeyValue always empty string in JSON responses
+- [Phase 18]: Single SSEHub shared between scan and recon progress endpoints, events distinguished by Type prefix
 
 ### Pending Todos
 
@@ -170,6 +174,6 @@ None yet.
 
 ## Session Continuity
 
-Last session: 2026-04-06T14:34:18.710Z
-Stopped at: Completed 17-04-PLAN.md
+Last session: 2026-04-06T15:07:44.683Z
+Stopped at: Completed 18-02-PLAN.md
 Resume file: None