docs(backend): track sprint-0 follow-ups + flag integration migration gap

- `tasks/todo.md`: B0.5 description updated (re2 hard dep, no fallback);
  add a "Backend follow-ups (sprint 1+)" section with M1-M7 + N1-N6 from
  the code-review verdict.
- `CHANGELOG.md`: backend skeleton bullets refreshed (no re fallback,
  streaming blob store, audit + scope on CRUD, 56 unit tests); new
  "Code-review remediation" subsection lists B1 / MA1-MA6 / N4 / N6 / M8
  with one-line rationale each.
- `tests/integration/conftest.py`: leave `db.create_all()` in place but
  add an inline TODO (N6) pointing at the Alembic switchover that will
  exercise the F11 seed + audit-log role grants in CI.

tasks/todo.md

@@ -16,9 +16,10 @@ Repo skeleton + foundational modules. Nothing that depends on PR1/PR2/PR3.
       evidence, report, soc_session, c2_credential, audit_log).
 - [x] B0.4 — `C2Connector` ABC + dataclasses + `payload_type` enum + factory keyed on
       `c2_type`. Mythic payload map populated; Home stays empty until PR2.
-- [x] B0.5 — Jinja2 SandboxedEnvironment, `regex_extract` filter (google-re2 with `re`
-      fallback) per D-011 semantics (fail-loud no-match), `{{ outputs.text }}` /
-      `{{ outputs.blob() }}` accessors with 10 MB cap.
+- [x] B0.5 — Jinja2 SandboxedEnvironment, `regex_extract` filter (`google-re2` hard
+      dependency per D-011, raises `RuntimeError` at boot if absent — no `re` fallback),
+      fail-loud no-match, `{{ outputs.text }}` / `{{ outputs.blob() }}` accessors
+      reading gzip-compressed blobs with 10 MB cap.
 - [x] B0.6 — bcrypt password helpers + SOC opaque token (256-bit url-safe, bcrypt-hashed) +
       group-based RBAC matrix matching F11 + `@require_perm` decorator.
 - [x] B0.7 — Flat CRUD blueprints for engagements / hosts / TTPs / scenarios (incl. step
@@ -26,6 +27,43 @@ Repo skeleton + foundational modules. Nothing that depends on PR1/PR2/PR3.
 - [x] B0.8 — pytest baseline: unit tests passing, integration scaffold ready
       (testcontainers Postgres + `/healthz` smoke).
 
+## Backend follow-ups (sprint 1+)
+
+Tracked from code-review verdict on `feature/backend-skeleton` @ 12d131c:
+
+### MINOR (8) — to schedule
+
+- **M1** — Replace `parse_uuid` integer-ish lookup with `werkzeug` UUID converter on
+  the routes (`<uuid:eid>`) to avoid the 404 on malformed strings being hidden by
+  the 400 path.
+- **M2** — Add OpenAPI generation (Pydantic 2 + `flask-pydantic-openapi` or hand-rolled).
+- **M3** — Wire `flask-limiter` for `/auth/local/login` (NF-network).
+- **M4** — Replace string-based `Engagement.status` setter with a typed transition method.
+- **M5** — Introduce per-engagement read view that pre-joins `engagement_member` for
+  RT operator dashboards (current per-request join is fine for v1 traffic, but
+  re-evaluate at scale).
+- **M6** — `mimic-cli user create` does not handle the SOC user-type (intended, but
+  document and gate explicitly with a clean error message).
+- **M7** — Add a `mimic-cli` `engagement add-member <uid> --role rt_operator` shortcut so
+  the F11 scoping in MA6 is reachable from the CLI without manual SQL.
+- **M8** — _(fixed in MA1 follow-up commit)_ Initial migration docstring no longer
+  references `ttp_version`.
+
+### NIT (6) — opportunistic
+
+- **N1** — Sort imports inside `mimic.db.models.__init__` alphabetically for diff
+  stability.
+- **N2** — Extract the `_engagement_or_404` duplicated body into a shared helper.
+- **N3** — Replace the inline `Permission.TTP_PROMOTE not in perms` check in `ttps.py`
+  with a second `@require_perm`-style decorator.
+- **N4** — _(fixed)_ `gunicorn` added to `pyproject.toml` dependencies.
+- **N5** — Replace bare `getattr(current_user, "groups", frozenset())` accesses by a
+  thin `current_groups()` helper.
+- **N6** — `tests/integration/conftest.py` uses `db.create_all()` instead of running
+  Alembic. Marked with a TODO; switch over once the F11 seed must be exercised in
+  integration. Plan: convert to `alembic upgrade head` once the audit role
+  bootstrap lives in the playbook (D-010).
+
 ## Frontend (`ux-frontend`)
 
 - [ ] F0.1 — `frontend/` Vite + React + TypeScript strict + Tailwind 4 + TanStack Query 5,