## 1. Frontend app scaffold and routing

- [x] 1.1 Create `apps/web/src` app entrypoint, base styles, and root render wiring.
- [x] 1.2 Add router configuration with dashboard, projects, repositories, ssh keys, settings, and not-found routes.
- [x] 1.3 Add protected-route guard and login redirect behavior for unauthenticated access.

## 2. Auth-aware shell and API client

- [x] 2.1 Implement shared API client with credentialed requests and 401 handling strategy.
- [x] 2.2 Implement auth session bootstrap (`/auth/me`) and lightweight auth context/provider.
- [x] 2.3 Implement app shell layout (header, desktop sidebar, mobile menu toggle, content outlet).
- [x] 2.4 Wire logout action to backend endpoint and session-state reset.

## 3. Dashboard and UX states

- [x] 3.1 Implement dashboard placeholder page with summary cards and quick actions.
- [x] 3.2 Add loading, empty, and error-retry states for dashboard/auth bootstrap paths.
- [x] 3.3 Ensure responsive behavior for mobile viewport navigation and touch targets.

## 4. Verification and OpenSpec tracking

- [x] 4.1 Add/update frontend tests for protected routing and auth/session behaviors.
- [x] 4.2 Run frontend quality gates (`npm run typecheck`, `npm run lint`, `npm run build`) and fix findings.
- [x] 4.3 Update this tasks file with completed checkboxes and note blockers/follow-ups.

## Blockers / Follow-ups

- None at this stage.