docs: add Trellis planning and project specs

.trellis/tasks/07-01-nextjs-fullstack-crud-rbac-audit/implement.md

@@ -0,0 +1,89 @@
+# Implementation Plan
+
+## Checklist
+
+1. Add core server modules:
+   - JSON store read/write helpers.
+   - Account/session/password helpers.
+   - Role and permission definitions.
+   - Audit logging helper.
+   - Shared API response helpers.
+
+2. Add auth APIs:
+   - `GET /api/auth/bootstrap`
+   - `POST /api/auth/setup`
+   - `POST /api/auth/login`
+   - `POST /api/auth/logout`
+   - `GET /api/auth/session`
+
+3. Migrate auth UI:
+   - Update `AuthPanel` to call server APIs.
+   - Update `SignOutButton` to call logout API.
+   - Replace or bypass localStorage-only `AuthGate` with server session protection in the app layout.
+   - Keep unauthenticated redirects and setup redirects working.
+
+4. Add elder APIs and UI:
+   - Create elder types and input validators.
+   - Implement list/create/update/delete Route Handlers.
+   - Replace `app/(app)/app/elders/page.tsx` static content with server-loaded CRUD UI.
+
+5. Add settings/audit UI:
+   - Implement settings/account, role, and audit APIs.
+   - Replace `app/(app)/app/settings/page.tsx` static content with server-loaded tables.
+
+6. Wire audit events:
+   - Account setup/create.
+   - Login/logout.
+   - Elder create/update/delete.
+   - Denied permission checks.
+
+7. Verification:
+   - Run `pnpm lint`.
+   - Run `pnpm type-check`.
+   - Run `pnpm build`.
+   - Start dev server and manually exercise setup/login/CRUD/settings if build passes.
+
+## Files Expected to Change
+
+- `modules/auth/components/AuthPanel.tsx`
+- `modules/auth/components/AuthGate.tsx`
+- `modules/auth/components/SignOutButton.tsx`
+- `app/(app)/app/layout.tsx`
+- `app/(app)/app/elders/page.tsx`
+- `app/(app)/app/settings/page.tsx`
+
+## Files Expected to Be Created
+
+- `modules/core/server/store.ts`
+- `modules/core/server/auth.ts`
+- `modules/core/server/permissions.ts`
+- `modules/core/server/audit.ts`
+- `modules/core/server/api.ts`
+- `modules/elders/types.ts`
+- `modules/elders/components/EldersClient.tsx`
+- `modules/settings/components/SettingsOverview.tsx`
+- `app/api/auth/bootstrap/route.ts`
+- `app/api/auth/setup/route.ts`
+- `app/api/auth/login/route.ts`
+- `app/api/auth/logout/route.ts`
+- `app/api/auth/session/route.ts`
+- `app/api/elders/route.ts`
+- `app/api/elders/[id]/route.ts`
+- `app/api/settings/accounts/route.ts`
+- `app/api/settings/roles/route.ts`
+- `app/api/audit-logs/route.ts`
+
+## Validation Commands
+
+```bash
+pnpm lint
+pnpm type-check
+pnpm build
+pnpm dev
+```
+
+## Rollback Points
+
+- If server auth blocks all app routes, revert only layout/AuthGate changes while keeping APIs.
+- If elder CRUD UI is unstable, keep APIs and temporarily render a read-only server table.
+- If file store causes build/runtime issues, move the data directory to `/tmp` behind the same store API for verification, then restore `.data` once filesystem assumptions are fixed.