chore: add ROADMAP.md as authoritative future-ideas file

AGENTS.md

@@ -88,3 +88,4 @@ When committing: `git add -A && git commit -m "<message>"` (conventional commits
 - Docs in same PR as feature (README, AGENTS, CHANGELOG).
 - Deprecate in minor, remove in next major; document Removed/Deprecated in CHANGELOG.
 - Lockfiles (uv.lock, package-lock.json, compose pins) — don't drift without reason.
+- Future implementation ideas → `ROADMAP.md` (authoritative); `CHANGELOG.md` is historical only.

README.md

@@ -40,6 +40,11 @@ needs judgment. Every step is documented and traceable.
   *Aufgaben* (approvals), *Verwaltung* (admin: access requests, import,
   sync, deploy).
 
+## Future
+
+Ideas and planned features live in [ROADMAP.md](ROADMAP.md)
+(the single authoritative place for future implementation ideas).
+
 ## Infrastructure
 
 One `docker-compose.yml` at the repo root runs the whole stack — identical

ROADMAP.md

@@ -0,0 +1,20 @@
+# Roadmap
+
+Future implementation ideas for kirche-einfach.
+Ideas live here until they ship (then a `feat:` commit + `[Unreleased]`
+entry in CHANGELOG.md). Keep entries short, ordered by priority.
+
+This file is the **authoritative place** for future ideas.
+`CHANGELOG.md` is historical (what shipped); `AGENTS.md` is rules/architecture.
+
+## Planned
+
+(none yet — add ideas here as they emerge)
+
+## Considered / not started
+
+- **Member form-filling page** — members fill out forms (attendance, sign-up) via the same input schema used by admins to *run* flows.
+- **Approval decision flow** — complete approve/reject-with-reason + member notification for access requests.
+- **E2E tests** — Playwright/Cypress smoke tests across key user journeys.
+- **CI pipeline** — complete Forgejo workflows (backend pytest, frontend build, compose validation, lint).
+- **Audit log** — track who submitted/approved what (church compliance).