docs: tandai Fase 5 API selesai di TODO

TODO.md

@@ -3,7 +3,7 @@
 > Plan lengkap migrasi in-place dari Rust (11 crate, clean architecture 4 lapis) ke monorepo
 > TypeScript/Bun. Bahasa Indonesia, commit pakai Conventional Commits.
 >
-> **Status:** Fase 0–2 + 3a–3g **selesai**; Fase 4 sebagian (**CLI**: parser arg, dispatch, komposisi root, REPL, bootstrap). Berikutnya: Fase 4 TUI + Fase 5 server interfaces.
+> **Status:** Fase 0–2 + 3a–3g **selesai**; Fase 4 CLI **selesai**; Fase 5 **API selesai**. Berikutnya: Fase 4 TUI + Fase 5 {daemon,ws,grpc,web}.
 > Base: `bun run check` bersih, 54 test hijau.
 
 ---
@@ -163,10 +163,11 @@ apps/
 ### Fase 5 — Server interface: api / daemon / ws / grpc / web
 **Sumber Rust:** `apps/interfaces/{api,daemon,ws,grpc,web}/src/**`, `apps/infrastructure/src/middleware/*`
 
-- [ ] **API** (`apps/interfaces/api/`):
-  - [ ] Endpoint: `auth` (login/register/refresh, rate-limited), `sessions` CRUD, `conversations`, `chat/completions` proxy, `health`
-  - [ ] JWT middleware, CORS
-  - [ ] DTO (dto/)
+- [x] **API** (`apps/interfaces/api/`):
+  - [x] Endpoint: `auth` (login/register/refresh, rate-limited), `sessions` CRUD, `conversations`, `chat/completions` proxy, `health`
+  - [x] JWT middleware, CORS
+  - [x] DTO (dto/)
+- [x] Smoke `bun run api`: health 200; register/login 200; wrong-pwd 401; protected-no-token 401; create/list/delete session; add conversation msg
 - [ ] **daemon** — IPC server + attach TUI client (pakai IPC 3g)
 - [ ] **ws** — handler `/ws`, protokol token/connected/done/error
 - [ ] **grpc** — stub (health endpoint)