docs: update roadmap and tracking for v0.4.0 wave 3

Mark v0.2.0 and v0.3.0 as done, set up wave 3 sprint targeting
local database plugins (geoip, asn, torcheck, iprep, cve).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

TODO.md

@@ -1,16 +1,6 @@
 # derp - Backlog
 
-## Wave 2 Plugins (stdlib) -- DONE
-
-- [x] `whois` -- raw socket WHOIS client (port 43)
-- [x] `portcheck` -- async TCP connect scan
-- [x] `httpcheck` -- HTTP status, redirects, response time
-- [x] `tlscheck` -- TLS version, cipher suite, cert chain, expiry
-- [x] `blacklist` -- DNSBL/RBL IP check
-- [x] `rand` -- passwords, hex strings, UUIDs
-- [x] `timer` -- countdown/stopwatch for time-boxed ops
-
-## Wave 3 Plugins (local databases)
+## Wave 3 Plugins (local databases) -- CURRENT
 
 - [ ] `geoip` -- GeoLite2-City mmdb (requires `maxminddb`)
 - [ ] `asn` -- GeoLite2-ASN mmdb (same package)
@@ -34,10 +24,10 @@
 
 ## Bot Features
 
-- [ ] SASL PLAIN authentication
-- [ ] Rate limiting (anti-flood, token bucket)
-- [ ] CTCP responses (VERSION, TIME, PING)
-- [ ] Admin/owner permission system (hostmask-based)
+- [x] SASL PLAIN authentication
+- [x] Rate limiting (anti-flood, token bucket)
+- [x] CTCP responses (VERSION, TIME, PING)
+- [x] Admin/owner permission system (hostmask-based)
 - [ ] Per-channel plugin enable/disable
 - [ ] Channel management commands (kick, ban, topic)
 - [ ] Multi-server support