docs(plan): tick Phase 10.4 csi-volumes → RD annotation

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -701,7 +701,7 @@ on the affected clusters.
 
 - [x] **`ControllerProps` instance → typed singleton CRD** (2026-05-10). `ControllerConfig` cluster-scoped CRD with `Spec.DRBDOptions` + `Spec.PassphraseSecretRef` + `Spec.ExtraProps`; canonical name `default`. ResourceReconciler.resolveEffectiveProps feeds the typed scope into `drbd.ResolveDRBDOptions` (was nil before) and folds ExtraProps into the output Props bag. Legacy KVEntry-shaped controllerProps() reader stays as forward-compat fallback for pre-migration clusters; both paths converge on the same wire shape.
 - [ ] **Cluster passphrase → native `Secret`**. New Secret (default name `blockstor-cluster-passphrase`, key `passphrase`). `ControllerConfig.Spec.PassphraseSecretRef` points at it. REST endpoints (`/v1/encryption/passphrase` POST/PATCH/PUT) rewritten to mutate the Secret.
-- [ ] **`csi-volumes` instance → per-Resource annotation**. linstor-csi's per-PVC JSON metadata moves to `Resource.metadata.annotations["blockstor.io/csi-volume-data"]`. Annotations have no size limit issue at csi-typical payloads (typically 1-4 KiB; per-object annotation cap is 256 KiB).
+- [x] **`csi-volumes` instance → ResourceDefinition annotation** (2026-05-10). REST handler routes `/v1/key-value-store/csi-volumes` traffic onto `ResourceDefinition.metadata.annotations["blockstor.io/csi-volume-data"]`. Each `OverrideProps` entry's key matches an RD name; the per-key value lands on that RD's annotation. GET assembles the inverse view by walking every RD. Per-key `DeleteProps` clears just one annotation; whole-instance DELETE strips the annotation from every RD that had it. NotFound on the RD lookup is soft-skipped so racy provision/deprovision sequences don't fail the batch. Other KV instances flow through the legacy KVEntry-backed store unchanged. Lands on RD (per-PVC) rather than Resource (per-replica) because csi-volumes is PVC-scoped — RD is the natural home; the original PLAN wording was off-by-one. Pinned by 3 contract tests.
 - [ ] **`csi-snapshot-shippings` instance → per-Snapshot annotation** (`blockstor.io/csi-shipping-data`).
 - [ ] **REST `/v1/key-value-store/{instance}` rewritten** on top of the new homes. `GET csi-volumes` does `client.List(Resources)` and assembles a map from annotations; `POST csi-volumes/{key}` writes the annotation on the matching Resource. golinstor sees the same shape.
 - [ ] **Drop `kventries.blockstor.io.blockstor.io` CRD** type registration, `api/v1alpha1/kventry_types.go`, `pkg/store/k8s/kv_store.go`, the `KeyValueStore` interface in `pkg/store/store.go`.