docs: define milestone v0.2 requirements (36 reqs, 6 categories)

UI overhaul, codebase quality, admin panel rearchitecture, UX
improvements, responsive layout, and performance/stack updates.
Research: STACK.md, FEATURES.md, ARCHITECTURE.md, PITFALLS.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.planning/PROJECT.md

@@ -8,103 +8,93 @@ DocuVault is a self-hosted, multi-user SaaS document management platform. Users
 
 Every user's documents — and the credentials they use to store them — are inaccessible to everyone except that user, while the platform scales horizontally and supports pluggable storage backends.
 
+## Current Milestone: v0.2 — UI Overhaul and Optimization
+
+**Goal:** Redesign the frontend into a polished, performant, and responsive interface, and overhaul both the backend and frontend codebase to senior-dev quality — minimal, DRY, readable code with no unnecessary comments.
+
+**Target features:**
+- Visual redesign — refined Tailwind component system, consistent palette, typography, spacing
+- UX & interaction improvements — drag-and-drop upload, keyboard shortcuts, empty states, loading skeletons
+- Frontend performance — lazy loading, virtual scrolling, bundle size reduction, API response caching
+- Responsive / mobile layout — adaptive layouts for phones/tablets, touch-friendly controls
+- Proper admin panel — standalone admin interface with its own routes, layout, and nav (not tabs bolted onto the user app)
+- Codebase quality overhaul — eliminate duplication, extract shared utilities, delete dead code, flatten unnecessary abstractions; comments only where code alone is insufficient
+
 ## Requirements
 
-### Validated
+### Validated (v0.1 — shipped 2026-06-06)
 
-*Capabilities already shipping in the codebase:*
+- ✓ Document upload and text extraction (PDF, DOCX, image, plain text)
+- ✓ AI-based topic classification via configurable provider
+- ✓ Multiple AI provider support (Anthropic, OpenAI, GenericOpenAI-compat, Ollama, LMStudio)
+- ✓ Topic CRUD management (per-user namespace)
+- ✓ Docker containerization (Compose) with PostgreSQL + MinIO
+- ✓ User registration with email/password (Argon2id, strength enforcement, HaveIBeenPwned check)
+- ✓ JWT session management (ES256 asymmetric, 15 min access token, 16h/30d refresh, token fingerprinting, JTI revocation)
+- ✓ TOTP 2FA with backup codes; session revocation on privilege change
+- ✓ Admin: create, deactivate, reset password, assign AI provider per user
+- ✓ Admin cannot access user documents or cloud credentials
+- ✓ Per-user isolated storage with 100 MB free-tier quota (atomic enforcement)
+- ✓ Folder creation, rename, delete, move documents between folders
+- ✓ Document sharing by handle (view/edit permission, revocable, no recipient quota charge)
+- ✓ "Shared with me" virtual folder
+- ✓ Cloud storage backends: OneDrive, Google Drive, Nextcloud, WebDAV (HKDF-encrypted credentials)
+- ✓ PDF in-browser preview (proxied, no presigned URL exposure)
+- ✓ Full-text search and sorting on document list
+- ✓ Audit log (metadata only): logins, uploads, deletes, shares, quota changes
+- ✓ Admin audit log viewer with date/user/action filters and CSV export
+- ✓ Structured JSON logging (structlog + correlation IDs)
+- ✓ Container hardening (non-root user, read-only filesystem, dropped capabilities)
+- ✓ AI provider settings in `system_settings` DB table (HKDF-encrypted API keys)
+- ✓ Celery retry backoff (30 s / 90 s / 270 s) on classification failure
+- ✓ Backend stateless — all state in PostgreSQL and MinIO
 
-- ✓ Document upload and text extraction (PDF, DOCX, image, plain text) — existing
-- ✓ AI-based topic classification via configurable provider — existing
-- ✓ Multiple AI provider support (Anthropic, OpenAI, Ollama, LMStudio) — existing
-- ✓ Topic CRUD management — existing
-- ✓ System prompt configuration — existing
-- ✓ Docker containerization (Compose) — existing
+### Active (v0.2 — this milestone)
 
-### Active
-
-**Users & Auth**
-- [ ] User can register with email and password (enforced strength: length, complexity, breach check)
-- [ ] User can log in and maintain session via JWT
-- [ ] User can enable TOTP authenticator app for 2FA
-- [ ] Admin can create, deactivate, and reset passwords for user accounts
-- [ ] Admin cannot access any user's documents or cloud storage credentials
-
-**Storage & Quotas**
-- [ ] Each user has an isolated storage area with a 100 MB free-tier quota
-- [ ] Quota usage is tracked and enforced; uploads exceeding quota are rejected with a clear error
-- [ ] Admin can adjust individual user storage quotas
-- [ ] Platform migrates from flat-file JSON + filesystem to PostgreSQL + MinIO (S3-compatible)
-
-**Folder Structure**
-- [ ] User can create, rename, and delete folders to organize documents
-- [ ] Document organization is preserved on move/rename (no auto-rearrangement by AI)
-- [ ] A "Shared with me" folder appears automatically when another user shares a document
-
-**Document Sharing**
-- [ ] User can share a document (or folder) with another user by their unique handle
-- [ ] Shared access is view-only by default; owner controls permission level
-- [ ] Revoking share removes access immediately; shared copy is not duplicated in recipient's quota
-
-**Cloud Storage Integration**
-- [ ] User can connect an external cloud storage backend (OneDrive, Google Drive, Nextcloud; extensible)
-- [ ] Local storage and cloud storage coexist; user selects their default storage destination
-- [ ] Cloud storage credentials are encrypted at rest and never readable by admins
-- [ ] Documents stored in cloud backend are accessed via the app without being re-copied to local storage
-
-**AI Configuration (Admin-controlled)**
-- [ ] Admin can assign an AI provider and model per user or per group
-- [ ] System-wide default AI provider and model set by admin
-- [ ] Users cannot change their own AI provider or model
-- [ ] Per-user topic overrides on top of system default topics
-
-**Audit Logging**
-- [ ] Audit log captures: logins, failed logins, uploads, deletes, sharing events, quota changes
-- [ ] Audit log records metadata only — no document content
-- [ ] Admin can view and filter audit logs
-
-**Scalability**
-- [ ] Backend stateless — multiple instances can run behind a load balancer
-- [ ] All state in PostgreSQL and MinIO (no local file locks, no per-instance JSON)
+*Defined in REQUIREMENTS.md*
 
 ### Out of Scope
 
-- Subscription billing / payment processing — future milestone (quotas designed to plug in)
+- Subscription billing / payment processing — future milestone (quota table designed for it)
 - SSO (Microsoft, Google, Apple) — future; auth layer designed for extension
 - Keycloak / SAML / OAuth enterprise federation — future
-- Group admin roles — future; groups table will be seeded in schema
+- Group admin roles — future; groups table seeded in schema
 - Document annotation or in-app editing — not planned
-- Mobile app — not planned
-- Public document sharing (unauthenticated link) — not planned for v1
+- Mobile native app — not planned (responsive web only in v0.2)
+- Public document sharing (unauthenticated link) — not planned for v0.x
 
 ## Context
 
-- **Existing codebase**: Functional single-user document scanner (FastAPI + Vue 3, Docker Compose). AI provider abstraction already in place — cloud storage will follow the same adapter pattern.
-- **Brownfield migration**: Flat-file JSON persistence and per-process file locks must be replaced with PostgreSQL + MinIO before multi-user isolation is safe.
-- **Privacy constraint**: SaaS model with strict admin/user data separation. Admin role is a platform operator, not a content viewer. Cloud credentials must be encrypted server-side; the encryption key must not be readable by admin queries.
-- **Free tier baseline**: 100 MB per user. Quota model should be designed so future subscription tiers can expand it without schema changes.
-- **Cloud storage**: Follows same provider/adapter pattern as existing AI providers. Each cloud integration is an adapter implementing a common StorageBackend interface.
+- **Current state**: v0.1 complete (2026-06-06). All foundation features shipped and security-hardened. App is functional for local/self-hosted use but not hardened for public internet deployment.
+- **Tech stack**: FastAPI 0.136+ (Python 3.12), SQLAlchemy 2.0 async, Alembic, MinIO SDK; Vue 3 (Options API), Pinia, Vue Router 4, Vite, Tailwind CSS.
+- **Code quality**: v0.1 was built feature-first under time pressure. Both backend and frontend contain duplication, inconsistent patterns, and components that grew beyond their original scope. v0.2 addresses this systematically.
+- **Admin panel**: AdminView.vue currently renders admin functionality as tabs appended to the main user layout. This is architecturally wrong — the admin interface needs its own route subtree, layout component, and nav.
+- **Privacy constraint**: Admin role is a platform operator, not a content viewer. Cloud credentials encrypted with per-user HKDF key; API keys encrypted with separate HKDF domain. Neither is ever in an API response.
 
 ## Constraints
 
-- **Tech stack**: FastAPI (Python) + Vue 3 — keep existing stack, extend it
-- **Database**: PostgreSQL (replaces flat-file JSON)
-- **Object storage**: MinIO (S3-compatible, Docker-native) — replaces local filesystem for documents
-- **Auth**: bcrypt passwords, JWT sessions, TOTP 2FA (PyOTP / similar)
-- **Cloud credentials**: Encrypted at rest (Fernet symmetric encryption or PostgreSQL pgcrypto) — key in env var, never in DB
-- **Scalability target**: Horizontal (multiple backend containers) — no file-system-level coordination
-- **Deployment**: Docker Compose (must remain the primary deployment target)
+- **Tech stack**: FastAPI (Python) + Vue 3 — keep existing stack, no framework switch
+- **Database**: PostgreSQL (Alembic-managed schema, 5 migrations completed)
+- **Object storage**: MinIO (S3-compatible, Docker-native)
+- **Auth**: Argon2id passwords, ES256 JWT, TOTP 2FA (pyotp), HKDF key derivation
+- **Deployment**: Docker Compose (primary deployment target, must remain so)
+- **No rewrites**: Refactor, don't rewrite. Preserve all existing functionality and test coverage.
 
 ## Key Decisions
 
 | Decision | Rationale | Outcome |
 |---|---|---|
-| PostgreSQL + MinIO over flat files | Multi-user quotas + horizontal scaling require shared, consistent state | Replacing JSON + filesystem |
-| Cloud storage adapter pattern | Mirrors existing AI provider pattern — consistent, extensible | New `storage/` module analogous to `ai/` |
-| Privacy-first admin model | SaaS legal/trust requirement — admins must not be able to access user data | Admin queries exclude document content; cloud creds encrypted with user-scoped key |
-| Admin controls AI config, not users | Prevents cost overruns and model misuse; future group-admin delegation designed in | AI provider assignment stored per-user in DB, configurable by admin |
-| 100 MB free tier | Baseline for subscription model; quota table has a `limit_bytes` column admin can override | Quota enforced at upload time |
-| TOTP 2FA before SSO | State-of-the-art security without third-party dependency; SSO added when subscription model lands | TOTP via authenticator app (RFC 6238) |
+| PostgreSQL + MinIO over flat files | Multi-user quotas + horizontal scaling require shared, consistent state | Shipped in v0.1 Phase 1 |
+| Cloud storage adapter pattern | Mirrors AI provider pattern — consistent, extensible | Shipped in v0.1 Phase 5 |
+| Privacy-first admin model | SaaS legal/trust requirement | Admin queries exclude document content; cloud creds encrypted with user-scoped key |
+| Admin controls AI config, not users | Prevents cost overruns and model misuse | AI provider assignment stored per-user in DB, configurable by admin only |
+| 100 MB free tier | Baseline for future subscription tiers | Quota table has `limit_bytes` column admin can override |
+| TOTP 2FA before SSO | State-of-the-art security without third-party dependency | Via pyotp (RFC 6238), shipped v0.1 Phase 2 |
+| ES256 over HS256 for JWT | Leaked public key cannot forge tokens; asymmetric signing | Shipped v0.1 Phase 7.3 |
+| Token fingerprinting (fgp claim) | Limits stolen access token replay to original device context | HMAC of User-Agent + Accept-Language, shipped v0.1 Phase 7.4 |
+| JTI claim + Redis revocation | Closes 15-min window where revoked session's access token stays valid | Shipped v0.1 Phase 7.2 |
+| Options API preserved in v0.2 refactor | Composition API migration is scope-creep for a UX milestone; refactor within Options API | Decision logged to prevent scope drift |
+| Admin panel as standalone route subtree | AdminView.vue as tabs-on-user-layout is an architectural mistake | v0.2 introduces /admin/* routes with own layout |
 
 ## Evolution
 
@@ -124,4 +114,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-05-21 after initialization*
+*Last updated: 2026-06-07 — milestone v0.2 started*