Restructure plan to TODO backlog with multi-user foundation

PLAN.md

@@ -11,12 +11,7 @@ that works end-to-end, not a half-finished layer.
 |-------|-------------|--------|
 | 0 | POC — tunnel, upload relay, reverse fetch | ✅ Done |
 | 1 | Android app — pick and upload photos | ✅ Done |
-| 2 | Agent — production-ready (reconnect, dedup) | ⬜ Pending |
+| TODO | Remaining work backlog (phase grouping TBD) | ⬜ Pending |
-| 3 | Broker — thumbnails + SQLite metadata | ⬜ Pending |
-| 4 | Web gallery — browse and view photos | ⬜ Pending |
-| 5 | Auth — user accounts + agent tokens | ⬜ Pending |
-| 6 | Android — background auto-backup | ⬜ Pending |
-| 7 | Play Store release | ⬜ Pending |
 
 ---
 
@@ -59,14 +54,12 @@ that works end-to-end, not a half-finished layer.
 
 ---
 
-## Phase 2 — Production Agent
+## TODO (Post-Phase 1 Backlog)
 
-**Goal:** Agent that survives in the real world with foundation for future direct client-node transfers.
+Phase grouping beyond Phase 1 is intentionally deferred. Use this backlog to
+pick what will become the next implementation phase(s).
 
-**Deliverable:** Go binary that reconnects automatically, deduplicates uploads,
+### Agent hardening
-organises photos by date on disk, and maintains internal database for robustness.
-
-**Tasks:**
 - [x] Linux user service (`memoric-agent`) via `systemctl --user` with `Restart=always` and storage path set to `~/memoric/photos`
 - [ ] Auto-reconnect with exponential backoff on disconnect
 - [ ] SHA-256 dedup — skip files already stored, return 200 without relaying
@@ -77,77 +70,31 @@ organises photos by date on disk, and maintains internal database for robustness
 - [ ] Encryption at rest for stored photos
 - [ ] Health reporting and capacity monitoring
 
----
+### Broker and gallery
-
-## Phase 3 — Broker: Thumbnails + Metadata
-
-**Goal:** Server knows what photos exist and can show them fast.
-
-**Deliverable:** Broker generates thumbnails on upload, stores metadata in
-SQLite. Gallery API returns photo list with thumbnail URLs.
-
-**Tasks:**
 - [ ] Thumbnail generation on upload (Pillow, WebP, 400px longest edge)
-- [ ] SQLite schema: `photos(id, filename, hash, timestamp, size, thumb_path, agent_id)`
+- [ ] SQLite schema evolution: `photos(id, filename, hash, timestamp, size, thumb_path, agent_id, user_id)`
 - [ ] `GET /photos` — return photo metadata list
 - [ ] `GET /thumb/{id}` — serve thumbnail directly from server (no tunnel)
 - [ ] `GET /photo/{id}` — proxy full-res through tunnel from agent
-
+- [ ] Web gallery page — responsive grid, lazy-load thumbnails
----
-
-## Phase 4 — Web Gallery
-
-**Goal:** Browse and view photos in a browser.
-
-**Deliverable:** Simple HTML gallery served by the broker. Thumbnails load
-fast from server; tap opens full-res through the tunnel. Offline badge when
-agent is disconnected.
-
-**Tasks:**
-- [ ] Gallery page — responsive grid, lazy-load thumbnails
 - [ ] Full-res modal — tap to open, close on tap-outside
 - [ ] Offline badge — grey overlay + icon when agent disconnected
 - [ ] Basic pagination or infinite scroll
 
----
+### Multi-user foundation
+- [ ] Data model boundaries: `users`, `agents`, `photos` with explicit ownership keys
+- [ ] Add `user_id` scoping to all photo/agent queries and APIs
+- [ ] Auth contracts: user JWT + per-agent token format and lifecycle
+- [ ] Pairing flow design: agent token issue, rotate, revoke
+- [ ] Endpoint auth matrix (public/private, required scopes)
+- [ ] Migration plan from current single-user data to multi-user-safe schema
 
-## Phase 5 — Auth
+### Android backup and release
-
-**Goal:** Users have accounts; agents are authenticated.
-
-**Deliverable:** Email + password login, JWT sessions, per-agent tokens.
-Photos are scoped to the authenticated user.
-
-**Tasks:**
-- [ ] User table in SQLite
-- [ ] `POST /register`, `POST /login` → JWT
-- [ ] Per-agent token issued at pairing time (QR code or token entry)
-- [ ] All endpoints require auth
-- [ ] Photos scoped to user — no cross-user access
-
----
-
-## Phase 6 — Android Background Backup
-
-**Goal:** Phone backs up automatically without opening the app.
-
-**Deliverable:** Background service that monitors the camera roll and uploads
-new photos on WiFi, with a persistent notification showing sync status.
-
-**Tasks:**
 - [ ] WorkManager job — runs on WiFi, respects battery saver
 - [ ] Camera roll watcher — detect new photos since last run
 - [ ] Upload queue with retry on failure
 - [ ] Persistent notification: "MemoriC — X photos synced"
 - [ ] Skip duplicates (check hash before uploading)
-
----
-
-## Phase 7 — Play Store Release
-
-**Goal:** Real users can install MemoriC.
-
-**Tasks:**
 - [ ] Sign release APK with keystore
 - [ ] Play Store listing — screenshots, description (no competitor brand names)
 - [ ] Privacy policy page (photos never stored on our servers)