Initial scaffold: tooling, plan, task briefs

- pnpm 10 workspace + TypeScript strict + ESLint flat + Prettier
- CLAUDE.md as canonical brief
- docs/tasks/ — 22 task briefs broken out by phase for sub-sessions
- docs/decisions/ — ADR scaffold

Implements task 01 (repo-init).

docs/tasks/README.md

@@ -0,0 +1,68 @@
+# Task briefs
+
+Each file here is a self-contained brief for a sub-session (typically Sonnet) to execute one chunk of work. Briefs assume the executor has read [`/CLAUDE.md`](../../CLAUDE.md) — do not restate the stack or architecture there.
+
+## How to use a brief
+
+1. Read `/CLAUDE.md` first.
+2. Read the task file end-to-end.
+3. Stop when **all** acceptance criteria pass. Do not bolt on extra scope.
+4. If a brief turns out to be wrong, update the brief in the same commit as the code.
+
+## Brief format
+
+Every task file has these sections:
+
+- **Goal** — one sentence.
+- **Why** — what this unlocks; how it fits the larger plan.
+- **Depends on** — task numbers that must be done first.
+- **Scope** — bullet list of what to build.
+- **Out of scope** — explicit non-goals to prevent drift.
+- **Acceptance criteria** — checkable list. Done = all checked.
+- **Notes** — gotchas, recommended libs, sketches.
+
+## Phase index
+
+### Phase 1 — Scaffold
+
+- [01 — Repo init & tooling](01-repo-init.md)
+- [02 — Next.js app skeleton](02-nextjs-skeleton.md)
+- [03 — Drizzle + Postgres setup](03-drizzle-postgres.md)
+- [04 — Module loader & registry](04-module-loader.md)
+- [05 — Compose stack & Caddy](05-compose-caddy.md)
+- [06 — Authentik install + OIDC integration](06-authentik-oidc.md)
+- [07 — Household seeding & session](07-household-seed.md)
+
+### Phase 2 — Core modules
+
+- [10 — Calendar module](10-calendar-module.md)
+- [11 — Lists module (shopping + task)](11-lists-module.md)
+- [12 — Notes module](12-notes-module.md)
+
+### Phase 3 — Dashboard & UX
+
+- [20 — Dashboard composition](20-dashboard.md)
+- [21 — Quick-add registry](21-quick-add.md)
+- [22 — Activity log](22-activity-log.md)
+
+### Phase 4 — Sharing
+
+- [30 — Share-link service](30-share-links.md)
+- [31 — Public share viewer (`/s/<token>`)](31-share-viewer.md)
+
+### Phase 5 — Notifications & reminders
+
+- [40 — Web Push (VAPID)](40-web-push.md)
+- [41 — Reminders engine](41-reminders.md)
+- [42 — Notification bus + ntfy adapter](42-notification-bus.md)
+
+### Phase 6 — PWA polish
+
+- [50 — Manifest, icons, install prompt](50-pwa-shell.md)
+- [51 — Offline shell + service worker caching](51-offline.md)
+
+### Phase 7 — Hardening
+
+- [60 — Postgres backups (pg_dump cron)](60-backups.md)
+- [61 — Rate limiting on share links](61-rate-limit.md)
+- [62 — Structured logging](62-logging.md)