docs: mark completed v2.0.0 items in ROADMAP.md

Reflect plugins already shipped: paste overflow, emailcheck, canary,
virustotal, abuseipdb, jwt, mac, pastemoni.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ROADMAP.md

@@ -112,19 +112,19 @@
 
 - [ ] Multi-server support (per-server config, shared plugins)
 - [ ] Stable plugin API (versioned, breaking change policy)
-- [ ] Paste overflow (auto-paste long output to FlaskPaste, return link)
+- [x] Paste overflow (auto-paste long output to FlaskPaste, return link)
 - [ ] URL shortener integration (shorten URLs in alerts and long output)
 - [ ] Webhook listener (HTTP endpoint for push events to channels)
 - [ ] Granular ACLs (per-command permission tiers: trusted, operator, admin)
 - [ ] `paste` plugin (manual paste to FlaskPaste)
 - [ ] `shorten` plugin (manual URL shortening)
-- [ ] `emailcheck` plugin (SMTP VRFY/RCPT TO)
-- [ ] `canary` plugin (canary token generator/tracker)
-- [ ] `virustotal` plugin (hash/URL/IP/domain lookup, free API)
-- [ ] `abuseipdb` plugin (IP abuse confidence scoring, free tier)
-- [ ] `jwt` plugin (decode tokens, show claims/expiry, flag weaknesses)
-- [ ] `mac` plugin (OUI vendor lookup, local IEEE database)
-- [ ] `pastemoni` plugin (monitor paste sites for keywords)
+- [x] `emailcheck` plugin (SMTP VRFY/RCPT TO)
+- [x] `canary` plugin (canary token generator/tracker)
+- [x] `virustotal` plugin (hash/URL/IP/domain lookup, free API)
+- [x] `abuseipdb` plugin (IP abuse confidence scoring, free tier)
+- [x] `jwt` plugin (decode tokens, show claims/expiry, flag weaknesses)
+- [x] `mac` plugin (OUI vendor lookup, local IEEE database)
+- [x] `pastemoni` plugin (monitor paste sites for keywords)
 - [ ] `cron` plugin (scheduled bot commands on a timer)
 - [ ] Plugin command unit tests (encode, hash, dns, cidr, defang)
 - [ ] CI pipeline