docs: record live Phase 25.5c deployment validation

- mark Phase 25.5c complete in PLAN
- record unraid migration/deploy and Pi API smoke tests
- note sync-ack metadata and temp provisioning helper validation

Co-authored-by: Copilot <[email protected]>

PLAN.md

@@ -1570,7 +1570,7 @@ updates its display-facing values without a manual restart once sync lands.
 
 ---
 
-  ### Phase 25.5c: Multi-device provisioning + force-sync UX — 🚧 PLANNED
+  ### Phase 25.5c: Multi-device provisioning + force-sync UX — ✅ COMPLETE
   Extend the current single-device portal page into a real multi-device management
   surface: register devices from the server, mint/rotate API keys, help the Pi
   consume those credentials without SSH-heavy manual steps, and expose an honest
@@ -1718,11 +1718,25 @@ updates its display-facing values without a manual restart once sync lands.
     - Device sync thread can restart after credentials are added later
     - Enabling **Sync with server** now validates that remote credentials exist
 
-  #### Pending validation
-  - Deploy Phase 25.5c to unraid + Pi
-  - Live smoke-test device creation / key rotation / local credential paste flow
-  - Confirm server-side **Request sync** and Pi-side **Sync now** behavior against
-    the running hardware
+  #### Validation
+  - Local tests expanded to `72 passed`
+  - Deployed Phase 25.5c to unraid and applied `migrate_phase25_5c.sql`
+  - Deployed Phase 25.5c to the Pi at `192.168.50.213`; `yaris-obd.service`
+    restarted cleanly
+  - Pi local API checks:
+    - `GET /api/remote-config` shows the saved remote server credentials state
+    - `POST /api/remote-config/test` succeeds with authenticated device creds
+    - `POST /api/remote-config/sync-now` succeeds (`no_change` when already current)
+  - Server sync-ack metadata verified live: `last_config_sync_version` matched the
+    current `config_version` for `yaris-2013`, and `last_config_sync_at` populated
+  - Temporary create/delete validation of the new device-provisioning helper
+    succeeded on the live server (`phase25c-validate-temp`)
+
+  #### Remaining polish ideas (not blockers)
+  - Exercise the authenticated browser flow for create/rotate/request-sync in the
+    live portal UI itself, not just the backing APIs/helpers
+  - If copy/paste provisioning feels too clunky in practice, add a later QR /
+    claim-code pairing flow
 
   ---