docs(11): create phase plan — 3 plans for search engine dorking + paste sites

.planning/ROADMAP.md

@@ -235,7 +235,12 @@ Plans:
   1. `keyhunter recon --sources=google` runs built-in dorks via Google Custom Search API or SerpAPI and returns results with the dork query that triggered each finding
   2. `keyhunter recon --sources=bing` executes dorks via Azure Cognitive Services and `--sources=duckduckgo,yandex,brave` via their respective integrations
   3. `keyhunter recon --sources=paste` queries Pastebin API and scrapes 15+ additional paste sites, feeding raw content through the detection pipeline
-**Plans**: TBD
+**Plans**: 3 plans
+
+Plans:
+- [ ] 11-01-PLAN.md — GoogleDorkSource + BingDorkSource + DuckDuckGoSource + YandexSource + BraveSource (RECON-DORK-01, RECON-DORK-02, RECON-DORK-03)
+- [ ] 11-02-PLAN.md — PastebinSource + GistPasteSource + PasteSitesSource multi-paste aggregator (RECON-PASTE-01)
+- [ ] 11-03-PLAN.md — RegisterAll wiring + cmd/recon.go credentials + integration test (all Phase 11 reqs)
 
 ### Phase 12: OSINT IoT & Cloud Storage
 **Goal**: Users can discover exposed LLM endpoints via IoT scanners (Shodan, Censys, ZoomEye, FOFA, Netlas, BinaryEdge) and scan publicly accessible cloud storage buckets (S3, GCS, Azure Blob, MinIO, GrayHatWarfare) for leaked keys
@@ -337,7 +342,7 @@ Phases execute in numeric order: 1 → 2 → 3 → ... → 18
 | 8. Dork Engine | 0/? | Not started | - |
 | 9. OSINT Infrastructure | 2/6 | In Progress|  |
 | 10. OSINT Code Hosting | 9/9 | Complete    | 2026-04-06 |
-| 11. OSINT Search & Paste | 0/? | Not started | - |
+| 11. OSINT Search & Paste | 0/3 | Planning complete | - |
 | 12. OSINT IoT & Cloud Storage | 0/? | Not started | - |
 | 13. OSINT Package Registries & Container/IaC | 0/? | Not started | - |
 | 14. OSINT CI/CD Logs, Web Archives & Frontend Leaks | 0/? | Not started | - |