What to build: Visiting any page or API endpoint without credentials presents a password prompt. Entering the single shared household password sets a long-lived signed cookie, after which the whole app behaves exactly as it does today, on every page, including after PWA install. Wrong password: try again, no lockout ceremony needed. See ADR-0001 — this ticket deliberately gates *everything*; the public read-only surface is restored by ticket 02.
The nightly backup job on the server must keep working unattended: requests from localhost are exempt, or the script can present a token from its environment.
Blocked by: None — can start immediately.
Status: done (commit 3e9c0b9, 2026-08-01)
/api/* endpoint are refusedand lead to a password prompt
for months; both household editors can be logged in at once
unchanged once authenticated (including camera access on the phone)
backup.py completes a backup and a restore against the running,auth-enabled server without interactive input