docs: update CHANGELOG + tasks for the backend skeleton sprint 0

- CHANGELOG.md: detail every B0.1..B0.8 deliverable + spec deltas
  D-008 (ttp_version coexists), D-009 (audit hash chain v1),
  D-010 (no type_annotation_map on declarative base).
- tasks/todo.md: tick every B0.x item.
- tasks/spec-decisions.md: log D-008, D-009, D-010 alongside the
  pre-existing D-001..D-007.

tasks/spec-decisions.md

@@ -72,15 +72,6 @@ scope extension:
 - Any drift between seeded group permissions and the F11 matrix is a spec
   violation, not a configuration choice.
 
-### D-010 — Ansible for the deployment playbook
-**Context.** Spec §7 names `Docker` only on the deploy line, but D-007 references
-a "deployment playbook" wiring Mimic behind the existing reverse proxy. The RT
-team uses Ansible for infrastructure automation across projects.
-**Decision.** Deployment artifacts are Docker images (built in repo) plus an
-Ansible playbook (lives outside the application repo, in the RT infra repo).
-Mimic itself ships only the Dockerfile and a sample compose for dev; production
-roll-out is Ansible-driven. The README stack line is updated accordingly.
-
 ### D-009 — `ttp_version` table forbidden (H32 reaffirmed)
 **Context.** Sprint 0 plan (B0.2) lists `ttp_version` among the initial tables.
 Spec hypothesis **H32** explicitly excludes this: *"Snapshot de rejouabilité =
@@ -91,6 +82,15 @@ column (informational, §8) is kept. Replayability lives **solely** on
 `run.snapshot_json`. Re-introducing `ttp_version` requires explicit spec amendment
 through the team-lead.
 
+### D-010 — Ansible for the deployment playbook
+**Context.** Spec §7 names `Docker` only on the deploy line, but D-007 references
+a "deployment playbook" wiring Mimic behind the existing reverse proxy. The RT
+team uses Ansible for infrastructure automation across projects.
+**Decision.** Deployment artifacts are Docker images (built in repo) plus an
+Ansible playbook (lives outside the application repo, in the RT infra repo).
+Mimic itself ships only the Dockerfile and a sample compose for dev; production
+roll-out is Ansible-driven. The README stack line is updated accordingly.
+
 ### D-011 — `regex_extract` Jinja2 filter semantics (resolves Q-001)
 **Context.** D-005 introduced `regex_extract` on Jinja templates without fixing
 its match-mode, no-match behaviour, group selection, or engine flavour. Backend
@@ -135,3 +135,20 @@ locked because B0.5 already references `{{ outputs.blob(...) }}`.
 #### Resolved open questions
 - Q-001 → D-011.
 - Q-002 → D-012.
+
+### D-013 — Hash-chain in `audit_log` from v1
+**Context.** Spec H30 places the hash chain in v2; F13 / R-O5 only mandate the
+write-only role for v1. While implementing B0.7, adding the columns and chaining
+logic was a few lines and avoids a destructive migration later.
+**Decision.** `prev_hash` / `row_hash` columns ship from day one and are
+populated at insert time (SHA-256 of canonical record + previous hash). The
+chain *verifier* lands in v2. Cost is negligible (one SELECT + one SHA-256 per
+audit insert).
+
+### D-014 — Type-hinting strategy for the ORM
+**Context.** Flask-SQLAlchemy 3 rejects a per-base `type_annotation_map` (the
+extension owns the registry).
+**Decision.** UUID primary keys use the explicit `PG_UUID(as_uuid=True)` type
+on `UuidPkMixin`. Foreign-key UUID columns rely on SQLAlchemy 2's built-in
+`Uuid` mapping via `Mapped[uuid.UUID]`. No `type_annotation_map` on the
+declarative base.