docs(04): mark research questions as resolved

.planning/phases/04-heatmap-interaction/04-RESEARCH.md

@@ -346,17 +346,13 @@ public function getData(array $options = []): mixed
 | A2 | `HeatmapWidget::getData()` receives `$options['user']` with the current user | Code Examples / Widget getData | Medium -- may need to get user from security token instead |
 | A3 | The Twig template can access widget data via `widget.data` or similar accessor | Architecture Patterns / Twig Template Changes | Medium -- need to verify how AbstractWidget passes data to templates |
 
-## Open Questions
+## Open Questions (RESOLVED)
 
 1. **How does AbstractWidget pass data to its Twig template?**
-   - What we know: `getData()` returns data, `getTemplateName()` returns the template path
-   - What's unclear: Whether the data is automatically available as a template variable, or needs explicit passing
-   - Recommendation: Check `AbstractWidget::render()` or the widget renderer to see how data flows to Twig. If `getData()` result isn't auto-available, the widget can override `getOptions()` to inject projects.
+   - RESOLVED: `WidgetExtension::renderWidget()` passes `getData()` result as `data` to the template. Plan 01 uses `data.projects` in Twig, which works via this mechanism.
 
 2. **Does the `/en/` prefix in the timesheet URL match all Kimai installations?**
-   - What we know: Kimai uses locale-prefixed routes. The route name is `timesheet`, resolved via `path('timesheet')` in Twig.
-   - What's unclear: Whether the JS-side URL should be hardcoded with `/en/` or derived from the page context
-   - Recommendation: Pass the timesheet base URL as another `data-` attribute on the container, generated via `{{ path('timesheet') }}` in Twig. This is locale-safe. **This is the correct approach.**
+   - RESOLVED: Use `data-timesheet-url="{{ path('timesheet') }}"` attribute on the container div. This generates a locale-safe URL via Symfony routing. Plan 01 adopts this approach.
 
 ## Validation Architecture