updating documentatin

documentation/backlog.md

@@ -8,9 +8,6 @@ Labels: `[feature]` `[infra]` `[security]` `[ux]` `[debt]`
 
 Things that are actively in progress or should be picked up immediately. Mostly operational risk and the remaining phase 7 hardening work.
 
-- **Migrations in the deploy pipeline** `[infra]` `[debt]`
-  Run `drizzle migrate` as a step in the CI/CD pipeline before the API container is restarted. Deploying code before schema is applied causes crashes. See `deployment.md` — deploy order is currently documented but not enforced.
-
 - **Rate limiting on API endpoints** `[security]`
   At minimum: auth endpoints (brute force prevention) and game endpoints (spam prevention). Consider `express-rate-limit`.
 
@@ -58,6 +55,7 @@ Clearly planned work, not yet started. No hard ordering — sequence based on wh
 
 - **Valkey for game session store** `[infra]`
   Add Valkey to the production Docker stack. Implement `ValkeyGameSessionStore` against the existing `GameSessionStore` interface. Required before multiplayer scales.
+  NOTE: the rate limiting middleware needs to be adjusted for valkey, see todo comment
 
 - **User stats endpoint + profile page** `[feature]`
   `GET /users/me/stats` returning games played, score history, etc. Frontend profile page displaying the stats.
@@ -113,6 +111,7 @@ Directionally right, timing is unclear. Revisit when the next/now work is done.
 
 Shipped milestones, newest first.
 
+- **04 - 2026 — Migrations in deploy pipeline** — Drizzle migrate runs as a CI/CD step before the API container restarts
 - **04 - 2026 — Phase 6: Production deployment** — Hetzner VPS, Caddy HTTPS, Forgejo CI/CD, daily DB backups, cross-subdomain auth
 - **04 - 2026 — Phase 5: Multiplayer game** — real-time simultaneous play, 15s server timer, live scoring, winner screen
 - **04 - 2026 — Phase 4: Multiplayer lobby** — WebSocket server, lobby create/join, real-time player list