Implement lists module and dev login setup

docs/tasks/09-production-dev-login-removal.md

@@ -0,0 +1,47 @@
+# 09 — Production dev-login removal gate
+
+## Goal
+
+Before the first production deployment, verify that development-only login/test shortcuts cannot be enabled accidentally in production.
+
+## Depends on
+
+- 06
+- 07
+- local dev-login setup in `docs/dev-login.md`
+
+## Scope
+
+- Review all production env sources:
+  - `.env.production.example`
+  - `deploy/compose.yaml`
+  - any host-level Docker Compose override files
+  - deployment secrets on the server
+- Confirm production does not set:
+  - `ENABLE_DEV_LOGIN=true`
+  - `DEV_LOGIN_EMAIL`
+  - `DEV_LOGIN_NAME`
+  - `DEV_HOUSEHOLD_NAME`
+- Confirm production Authentik variables are real:
+  - `AUTH_OIDC_ISSUER`
+  - `AUTH_OIDC_CLIENT_ID`
+  - `AUTH_OIDC_CLIENT_SECRET`
+- Build with production-like env and verify `/login` renders only the SSO login path.
+- Verify the app still protects private routes without a valid Auth.js session cookie.
+- Verify real Authentik login creates the expected user, household membership, default calendars, and default lists.
+- Remove any accidental dev users from the production database.
+
+## Optional hardening
+
+- Remove `src/lib/dev-login.ts` and the Dev login form from `src/app/login/page.tsx` entirely before first production deployment.
+- If retaining the code for future local development, keep the current double gate:
+  - `NODE_ENV !== "production"`
+  - `ENABLE_DEV_LOGIN=true`
+
+## Acceptance criteria
+
+- [ ] Production env cannot enable Dev login accidentally.
+- [ ] `/login` in production does not show **Dev login**.
+- [ ] Direct dev-login action execution is unavailable in production.
+- [ ] Real Authentik login works on the production domain.
+- [ ] No `dev@famapp.local` or configured dev-login user exists in production data.