## 1. Scaffold & Database

- [ ] 1.1 Initialize Go module `frontend/` (go 1.22+), directory layout: `internal/db`, `internal/auth`, `internal/handlers`, `templates/`, `static/`
- [ ] 1.2 Create `db/schema.sql` (users, tags, scans per database spec) — idempotent `CREATE TABLE IF NOT EXISTS`
- [ ] 1.3 Add `Makefile` targets: `db-up` (apply schema), `seed`, `generate` (sqlc), `run`
- [ ] 1.4 Add `sqlc.yaml` + `internal/db/queries.sql` covering: create user, get user by email/id, bind tag, list tags by owner, get tag by code, update tag details, remove tag; run `sqlc generate`
- [ ] 1.5 Implement config (DATABASE_URL, SESSION_SECRET, port 3020) and `main.go` wiring pgx pool + router + static/template serving

## 2. Auth (user-auth spec)

- [ ] 2.1 Register: handler + template (email, password, name), bcrypt hash, unique-email error, auto-login after register
- [ ] 2.2 Login/logout: handlers + gorilla/sessions cookie store (HttpOnly, SameSite=Lax), redirect to account after login
- [ ] 2.3 RequireAuth middleware for account routes + `currentUser` helper injected into all templates

## 3. Tag Management (tag-management spec)

- [ ] 3.1 Add-tag handler: bind by tag code — reject already-bound tags, enforce 20-tag limit, show errors
- [ ] 3.2 My Tags page: list owned tags with status + edit links
- [ ] 3.3 Tag edit page + form: item type (dog/cat/baggage/skis/other), description, photo URL, phone, address, notes; saving sets status `active`
- [ ] 3.4 Remove-tag handler: reverts tag to `unset` (re-bindable)

## 4. Public Tag Page (public-tag-page spec)

- [ ] 4.1 `GET /t/{tag_code}` handler with tag lookup + friendly "tag not found" page for unknown codes
- [ ] 4.2 Render logic: `unset` → setup prompt with register/login links; `active` → return details; `suspended` → unavailable message
- [ ] 4.3 Owner edit affordance: edit link shown only when logged-in user owns the tag
- [ ] 4.4 Base layout + home page with Tailwind (CDN) styling; wire static assets

## 5. Seed & Verification

- [ ] 5.1 Seed script inserting test tag codes (e.g. TEST000001..TEST000010)
- [ ] 5.2 End-to-end manual verification of every spec scenario: register, duplicate email, login/logout, unauth redirect, bind unset tag, bind owned tag rejected, 20-tag limit, edit → active, remove → re-bind, unknown code page, suspended tag
- [ ] 5.3 Run `openspec validate frontend-foundation`; commit all artifacts and code
