What to build: The app running on the owner's server, reachable from a phone browser over the public internet. HTTPS and basic auth are provided by a reverse proxy (Caddy) in front of the app; the app itself contains no auth (per ADR-0002). Includes a service definition so the app survives reboots, and a backup story for the single SQLite file. Deliberately scheduled early: once this lands, every later slice ships by pulling and restarting.
Blocked by: 01 — Walking skeleton.
Status: claimed