phases: convert TODO.md to phases 12-15 (store, NUT verdicts, LLM page, TLS)

The five TODO items become four phases: 12 NUT self-test verdict wording
(assess() passes through 'Done and passed' to warn), 13 LLM page fleet/strip
spacing plus the decode tok/s spike (labelled counter sums, unbounded
estimator span), 14 store performance (full-scan read paths, maintain()
rollup write window, WAL tuning), 15 NUT privileged-action security
(collector-managed root CA, STARTTLS, account gate documented).

TODO.md is cleared; .agents/phases/todo/ is the source of truth.

LLM-Generated: true

TODO.md

@@ -1,6 +1 @@
 # TODO
-
-- [ ] "Last self-test: Done and passed" still shows up as a warning in the overview and UPS section
-- [ ] In the LLM engines page the "fleet" section has no spacing between it and the engine summaries
-- [ ] Decode tok/s sometimes jumps unrealistically high, could be a calculation error
-- [ ] For privileged actions (UPS commands) the exporter should be installed with password protection and that password must be used to register it with the collector. Effectively the exporters become protected web servers. Additionally, the collector should generate and manage a root certificate that needs to be installed with each exporter. In fact, just use the certs as auth rather than a password.