Update README for admin HTTP API, mark tasks completed

- Replace admin socket section with admin HTTP API section
- Update config table (admin_socket_path → admin_key_path)
- Update project structure (admin/auth.rs, handler.rs, config/mod.rs)
- Update architecture diagram (Admin HTTP API instead of Unix socket)
- Update Docker compose volume (admin-key instead of socket dir)
- Mark all four task files as status: completed with summaries

tasks/fix/agents-md-project-structure.md

@@ -1,7 +1,7 @@
 ---
 id: fix/agents-md-project-structure
 name: Update AGENTS.md project structure and common modifications after admin refactor
-status: pending
+status: completed
 depends_on: [fix/admin-http-api]
 scope: narrow
 risk: low
@@ -77,4 +77,9 @@ Unix socket (tokio::net::UnixStream).
 
 ## Summary
 
-> To be filled on completion
+Updated project structure (admin/auth.rs, handler.rs, mod.rs; config/mod.rs),
+architecture concepts (admin HTTP API, TOCTOU check, wildcard bind consistency),
+config format (admin_key_path), testing (HTTP-based admin tests), and common
+modifications (curl commands replacing socat). Updated README.md with same
+changes: admin HTTP API section, project structure, architecture diagram, config
+table, and Docker compose volumes.

tasks/fix/config-reload-toctou.md

@@ -1,7 +1,7 @@
 ---
 id: fix/config-reload-toctou
 name: Add mtime check to config reload to detect mid-write file changes (ADR-029)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: low
@@ -97,4 +97,7 @@ log a warning: "config file changed during read, please retry SIGHUP".
 
 ## Summary
 
-> To be filled on completion
+Implemented `read_and_validate_config()` in `src/config/mod.rs` with mtime check
+before/after reading. Both SIGHUP and admin HTTP reload paths use this shared
+function. `ReloadError::FileChangedDuringRead` returns HTTP 409 Conflict from
+the admin endpoint and logs a warning on SIGHUP. 7 new unit tests added.

tasks/fix/review-005-status-update.md

@@ -1,7 +1,7 @@
 ---
 id: fix/review-005-status-update
 name: Update security review #005 status to reflect ADR-028 decision
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: low
@@ -68,4 +68,8 @@ resolution status.
 
 ## Summary
 
-> To be filled on completion
+Updated review #005 status to `resolved`, added resolution table annotating all
+findings. Updated W2/W5/W6 rows to show resolved status. Updated reviewed_code
+to reference new admin files (auth.rs, handler.rs, mod.rs). Updated review #006
+status to `resolved`, replaced Category 6 (admin socket → admin HTTP API),
+updated entries 4.2, 4.3, P4, and reviewed_code for new file paths and mtime check.

tasks/fix/wildcard-flag-reload.md

@@ -1,7 +1,7 @@
 ---
 id: fix/wildcard-flag-reload
 name: Store cli_allow_wildcard_bind in ConfigReloadHandle for consistent reload validation (ADR-030)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: low
@@ -109,4 +109,8 @@ parameter. Add a test that verifies:
 
 ## Summary
 
-> To be filled on completion
+Added `cli_allow_wildcard_bind: bool` field to `ConfigReloadHandle`, stored at
+construction time from `LoadedConfig.allow_wildcard_bind`. `reload()` now passes
+`self.cli_allow_wildcard_bind` to `validate()` instead of hardcoded `false`.
+All call sites updated. 2 new unit tests verify wildcard bind acceptance/rejection
+on reload.