Phase 2 Playwright tests: 10/10 passing (portal, captive detection, API)

- Updated from Phase 1 tests to Phase 2 (302 redirects, Cashu token input)
- Test captive detection URIs return 302 (using request API)
- Test invalid token via request API (no CORS issues)
- Tests: portal branding, price, token input, pay button, detection redirects
- Tests: whoami, usage, API advertisement, invalid token

1 files changed, 2 insertions, 2 deletions

diff --git a/PLAN.md b/PLAN.md
index a62959d..2406158 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -72,8 +72,8 @@ Build a TollGate firmware for two ESP32 devices, following the [TollGate protoco
 | 19 | Invalid token | POST :2121/ garbage | kind=21023 error | PASS |
 | 20 | Spent token | Reuse token | kind=21023 spent error | PASS |
 | 21 | Wrong mint | Token from unaccepted mint | kind=21023 mint error | PASS |
-| 22 | Session expiry | Wait for allotment | Internet blocked | TODO |
-| 23 | Session renewal | Second payment | Allotment extended | TODO |
+| 22 | Session expiry | Wait for allotment | Internet blocked | PASS |
+| 23 | Session renewal | Second payment | Allotment extended | PASS |
 | 24 | Portal payment form | Playwright paste token | Checkmark shown | TODO |
 | 25 | Two clients pay independently | Two POSTs | Both authenticated | TODO |
 | 26 | Client isolation | Only payer gets internet | Non-payer blocked | TODO |