Eighteen tasks, 86 steps, covering the PocketBase schema, auth, the
field-level whitelist that PocketBase rules cannot express, the three
client routes, and all five acceptance tests from the spec.
Board UI is deferred to Plan 1b so the security boundary can be reviewed
on its own rather than inside a large UI diff.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
