docs: update for v1.5.0 features

- Add PKI audit logging, request duration metrics to features list
- Update test count from 216 to 283
- Add audit.py and metrics.py to project structure
- Document audit logging in api.md
- Update TASKLIST.md with completed tasks
- Update TODO.md (remove resolved debt items)
- Update ROADMAP.md decision log

TODO.md

@@ -9,11 +9,12 @@ Unstructured intake buffer for ideas, issues, and observations. Items here are r
 - Rate limit headers in responses (X-RateLimit-*)
 - Paste compression for large text content
 - ETag support for conditional requests
-- Paste listing for authenticated users (their own pastes only)
 - Neovim/Vim plugin for editor integration
 - Webhook notifications for paste events
 - Certificate renewal reminder in CLI
 - Admin endpoint for CA key rotation
+- Shell completions (bash, zsh, fish)
+- Clipboard integration (pbcopy/xclip)
 
 ## Observations
 
@@ -23,6 +24,9 @@ Unstructured intake buffer for ideas, issues, and observations. Items here are r
 - CI pipeline: lint runs parallel with security, tests wait for lint
 - Ruff replaces flake8/isort/pyupgrade with single fast tool
 - Bandit configured for medium+ severity only (-ll flag)
+- PKI audit events now logged: CERT_ISSUED, CERT_REVOKED, AUTH_FAILURE
+- Request duration metrics recorded via Prometheus histogram
+- Memory leak tests use tracemalloc to detect leaks (CI job)
 
 ## Questions
 
@@ -36,8 +40,6 @@ Unstructured intake buffer for ideas, issues, and observations. Items here are r
 ## Debt
 
 - Mypy has pre-existing type errors (runs with --ignore-missing-imports)
-- No integration tests for container deployment
-- Missing test for concurrent paste creation
 - Could add more deployment examples (Kubernetes, systemd)
 
 ## External Dependencies