feat: Slice 0 — Auth + Task Capture Spine

[Muzaffar-codes07]

Summary

Smallest end-to-end loop that proves the architecture: signed-in user opens a ⌘K palette, types a task title, presses Enter, and sees it persist in a list — Postgres write and task.created event on the events:tasks Redis Stream.

• Backend: Task model + Alembic 0003 migration, TaskService dual-write (Postgres + Redis), POST / GET / DELETE /v1/tasks (DELETE is idempotent), user_uuid() uuid5 mapping bridging Google sub → UUID, fakeredis-backed pytest fixtures.
• Frontend: Next.js BFF proxy at /api/tasks (hardened: 401/400/503/non-JSON guards, 204 short-circuit), React Query v5 provider + useTasks / useCreateTask / useDeleteTask hooks, ⌘K command palette, /dashboard with empty state / list / delete buttons / error UI, Google sign-in landing.
• Plan + decisions: docs/superpowers/plans/2026-05-18-slice-0-auth-task-capture-spine.md, docs/decisions/2026-05-18-data-layer.md. CURRENT_SLICE.md advanced to Week 3–4 Scaffolding.

Test plan

• cd apps/api && python -m pytest -q → 27 passed (auth, validation, persistence, event emission, ordering, user isolation, idempotent delete × 3)
• pnpm --filter @lockin/web test → 4 passed (palette: closed renders nothing, trim+submit on Enter, blank guard, reset on reopen)
• pnpm --filter @lockin/web typecheck → clean
• pnpm --filter @lockin/web lint → clean
• cd apps/api && python -m mypy app → clean (strict)
• Manual smoke test — sign in via Google → ⌘K → type → Enter → verify task in tasks table and task.created entry in XRANGE events:tasks - +, then refresh → row persists

Carried-forward (non-blocking, deferred per plan)

• Migration 0003/0002 have no DB-side gen_random_uuid() default on id (ORM-only)
• No transactional outbox — Redis publish-after-commit can theoretically drop an event on failure
• No monotonic tiebreaker on created_at ordering (very low real-world flake probability)
• BFF DELETE uses ?id= query string; TODO(week-3-4) marker added to refactor to [id] segment when PATCH lands
• Local env note: a native Postgres on Windows shadowed Docker's :5432; backend tests run against the native instance (the Docker lockin_test DB is unused). The dev lockin DB needs alembic upgrade head before the manual smoke test.

🤖 Generated with Claude Code

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}