- Session login for the single user Sam: server-side session store with an
HMAC-signed session cookie, POST /login, POST /logout, and double-submit
CSRF on every form post. Unauthenticated requests to / and /partials/*
redirect to /login?next=...
- Empty dashboard shell in the Family Home Lab design system: left nav
(category and folder placeholders), centre list, right detail pane.
- Copy tokens.css and the self-hosted Inter fonts from the family-home-lab
design system into web/static; vendor htmx 2.0.4. No cross-project imports
at runtime.
- Dark mode via prefers-color-scheme plus a persisted toggle; phone-first
layout with 44px touch targets, hairline borders, 8px grid, pill CTAs.
- Config: EMAIL_AGENT_PASSWORD for the login password, falling back to
EMAIL_AGENT_SESSION_SECRET so one configured secret is enough.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
