docs(04-review-download-security): create phase 4 plan

5 plans across 5 waves: Wave 0 TDD stubs, utilities + OutputBlock,
ReviewStep implementation, App.tsx wiring, human verify checkpoint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.planning/phases/04-review-download-security/04-05-PLAN.md

@@ -0,0 +1,116 @@
+---
+phase: 04-review-download-security
+plan: 05
+type: checkpoint
+wave: 5
+depends_on: [04-04]
+files_modified: []
+autonomous: false
+requirements: [CONF-02, CONF-03, DOWN-01, DOWN-02, DOWN-03, DOWN-04, DOWN-05, DOWN-06, SECU-01, SECU-02, SECU-03]
+
+must_haves:
+  truths:
+    - "IT admin can navigate the full 4-step wizard end-to-end in a real browser"
+    - "Security checkbox gate prevents downloads until acknowledged"
+    - "All four individual file downloads work in the browser"
+    - "ZIP bundle downloads and contains all 4 files"
+    - "Copy-to-clipboard works for each output block"
+    - "No data is written to localStorage or sessionStorage at any point"
+  artifacts:
+    - path: "src/components/wizard/ReviewStep.tsx"
+      provides: "Visually verified step 3 component"
+    - path: "src/utils/downloadFile.ts"
+      provides: "Verified individual download helper"
+    - path: "src/utils/downloadZip.ts"
+      provides: "Verified ZIP bundle helper"
+  key_links:
+    - from: "Browser navigation (steps 0→3)"
+      to: "ReviewStep rendered at step 3"
+      via: "App.tsx step router"
+      pattern: "n/a"
+---
+
+<objective>
+Human verification of the complete Phase 4 feature set in a running browser. All automated tests pass, but ZIP content, actual file downloads, and clipboard paste cannot be verified by jsdom.
+
+Purpose: Confirm the full IT admin workflow — complete wizard, review generated files, acknowledge security warning, download individually and as ZIP, copy to clipboard — works correctly end-to-end.
+Output: Human approval that Phase 4 is shippable.
+</objective>
+
+<execution_context>
+@C:/Users/SebastienQUEROL/.claude/get-shit-done/workflows/execute-plan.md
+@C:/Users/SebastienQUEROL/.claude/get-shit-done/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/ROADMAP.md
+</context>
+
+<tasks>
+
+<task type="checkpoint:human-verify" gate="blocking">
+  <what-built>
+    Complete Phase 4 feature set:
+    - ReviewStep (step 3) with live rclone.conf preview
+    - Security acknowledgement checkbox gate (all downloads disabled until checked)
+    - "No data sent to server" client-side notice
+    - Individual download buttons for rclone.conf, intune-install.ps1, intune-detection.ps1, rmm-script.ps1
+    - Copy-to-clipboard button per output block
+    - "Download All (ZIP)" button producing rclone-deployment.zip with all 4 files
+    - 4-label StepIndicator (Backend > Remote Config > Deployment > Review)
+    - Full automated test suite GREEN (including SECU-03 localStorage spy)
+  </what-built>
+  <how-to-verify>
+    Run the dev server: `npm run dev` then open http://localhost:5173
+
+    Step 1 — Navigate the full wizard:
+    1. Select a backend (e.g., Azure Blob)
+    2. Enter a remote name and fill in all required fields (storage account, SAS token or access key)
+    3. Proceed to Deployment Options, leave defaults or adjust, click Next
+    4. Confirm you reach step 4 "Review" with StepIndicator showing "1. Backend › 2. Remote Config › 3. Deployment › 4. Review"
+
+    Step 2 — Verify the live preview (CONF-02):
+    5. The rclone.conf output block shows a populated INI-format config reflecting your entered values
+    6. Go back to step 2, change a field value, return to step 4 — verify the preview updated
+
+    Step 3 — Verify security gate (SECU-01, SECU-02):
+    7. Before checking the checkbox: confirm all Download and Copy buttons appear disabled/greyed out
+    8. Confirm the "No data is sent to any server" notice is visible
+    9. Check the acknowledgement checkbox — confirm all buttons become active
+
+    Step 4 — Individual downloads (DOWN-01 through DOWN-04):
+    10. Click "Download" on the rclone.conf block — verify rclone.conf file saved to Downloads
+    11. Click "Download" on Intune Install Script — verify intune-install.ps1 saved
+    12. Click "Download" on Intune Detection Script — verify intune-detection.ps1 saved
+    13. Click "Download" on RMM Script — verify rmm-script.ps1 saved
+
+    Step 5 — Clipboard copy (CONF-03, DOWN-06):
+    14. Click "Copy" on the rclone.conf block — paste into a text editor, verify content matches displayed preview
+    15. Click "Copy" on at least one script block — verify clipboard content matches displayed script
+
+    Step 6 — ZIP bundle (DOWN-05):
+    16. Click "Download All (ZIP)" — verify rclone-deployment.zip saved to Downloads
+    17. Open the ZIP file with your OS ZIP tool — verify it contains exactly 4 files: rclone.conf, intune-install.ps1, intune-detection.ps1, rmm-script.ps1
+
+    Step 7 — SECU-03 (no storage writes):
+    18. Open DevTools → Application → Local Storage and Session Storage
+    19. Navigate the full wizard end-to-end — verify both storage areas remain empty at all times
+  </how-to-verify>
+  <resume-signal>Type "approved" if all checks pass, or describe which checks failed with details</resume-signal>
+</task>
+
+</tasks>
+
+<verification>
+Human approval received. All 7 verification steps confirmed passing. Phase 4 requirements CONF-02, CONF-03, DOWN-01–DOWN-06, SECU-01, SECU-02, SECU-03 verified in a real browser.
+</verification>
+
+<success_criteria>
+- Human has confirmed "approved" after completing all 18 verification steps
+- No failures reported for any requirement behavior
+- Phase 4 declared complete
+</success_criteria>
+
+<output>
+After approval, create `.planning/phases/04-review-download-security/04-05-SUMMARY.md`
+</output>