## 1. Backend project API and ownership enforcement

- [x] 1.1 Add/extend project API routes for create, list, update, delete, and default-ssh-key set operations.
- [x] 1.2 Implement project service layer ownership checks using authenticated user identity.
- [x] 1.3 Implement/verify cascade semantics for project deletion with repository cleanup behavior.
- [x] 1.4 Add backend tests for authenticated CRUD, ownership-denied scenarios, and default-key validation.

## 2. Frontend project management flows

- [x] 2.1 Add project API client methods for list/create/update/delete/default-key operations.
- [x] 2.2 Implement projects page with list and empty/loading/error states.
- [x] 2.3 Implement project create/edit form interactions and validation messaging.
- [x] 2.4 Implement delete flow and UI refresh behavior after mutations.
- [x] 2.5 Add frontend tests for protected project routes and mutation flows.

## 3. Verification and OpenSpec tracking

- [x] 3.1 Run backend checks (`pytest`, `ruff check src tests`, `mypy src`) and fix findings.
- [x] 3.2 Run frontend checks (`npm test`, `npm run typecheck`, `npm run lint`, `npm run build`) and fix findings.
- [x] 3.3 Update this tasks file with completed checkboxes and document blockers/follow-ups.

## Blockers / Follow-ups

- No blocking issues remain for this change.
- Frontend test run shows non-blocking Vite deprecation warnings related to esbuild options from `vite:react-babel`; behavior is unaffected and can be handled in a later tooling cleanup change.