P2.1: record flow-step <-> subplan-slice scope mapping

Document the already-decided decomposition of subplan-02 Slice 1 so the
P2.1 boundary is verifiable from the repo:
- P2.1 = Core Structs + boundary validation (validation portion of Slice 1)
- P2.3 = in-memory repository + db.json (rest of Slice 1)
- Token = Slice 5 (Token Security), out of both

Planning-doc record only; no domain or test code changed.

.agents/subplans/02-domain-and-storage.md

@@ -1,5 +1,10 @@
 # Subplan 02 - Product Domain And Storage
 
+> **Flow decomposition:** Slice 1 is split across two flow steps — **P2.1**
+> (Core Structs + boundary validation) and **P2.3** (in-memory repository +
+> `db.json` persistence). Token ships in **Slice 5 - Token Security**, not
+> Slice 1. See "Milestone 1 — Flow Step ↔ Subplan Slice Mapping" in `PLAN.md`.
+
 ## Goal
 
 Define the distribution platform's core data model and persistence layer once