- JWT via jose (HS256, 7d expiry) - Login API: POST /api/auth/login → returns token - Verify API: GET /api/auth/me - Middleware checks Bearer header or cookie - Token stored in localStorage + cookie (for SSR) - Authentik button (disabled, placeholder) - Auth headers auto-added to API requests
- Kanban with drag-and-drop (5 columns) - Project sidebar navigation - API client (projects, tasks, agents, labels) - Tailwind CSS dark theme - Docker support, SSR with internal API URL - Port 3100 (3000 occupied by Gitea)
