Planned and executed phase001

planning/phase005

@@ -0,0 +1,24 @@
+# Phase 005: Lightweight Internal Authentication
+
+## Goal
+Implement simple internal identity tracking without passwords.
+
+## Work
+- Add a monthly access key concept for initial identification.
+- Add a flow where a person enters/scans the current key, provides name/email, and receives a session.
+- Store only a session user id/token in the browser after verification.
+- Add `Current.user` or controller helper methods for accessing the active user.
+- Require an identified user before creating fuel or maintenance entries.
+- Keep admin/regular user roles out of scope for now.
+
+## Deliverables
+- Login/identification page.
+- Session creation and clearing.
+- User creation or lookup by email.
+- Controller specs/request specs for authenticated and unauthenticated flows.
+
+## Acceptance Criteria
+- Passwords are not used.
+- Raw QR/monthly key is not required on every request after session creation.
+- Fuel and maintenance submissions are attributed to the active user.
+- Unidentified users cannot submit entries.