feat: router with RJSF workflows and access management UI

PLAN_NEXT.md

@@ -41,11 +41,9 @@ build`, `docker compose config`, container rebuild. CI covers all three
 pytest` (attached api, from `backend/`), `docker compose exec frontend npm
 run build`, `docker compose config --quiet`.
 
-**Still open (docs-only):** `README.md` + `.env.example` uncommitted diff
-describes the target vision (access mgmt, dynamic forms, new Web UI) that is
-NOT yet implemented: `backend/components/kirche/` is
-empty, frontend is still the old 3-tab UI, no `input-schema` endpoint.
-(Phase 1 backend auth IS implemented since this was written.)
+**Still open:** nothing from the original list — Phases 1–4 are implemented
+(see §0.2). Remaining eyeball checks: `kirche` category in the Langflow
+palette, RJSF form UX in a browser, magic-link mail with real SMTP.
 
 ## 0.1 Follow-up fixes (commits after Phase 0)
 
@@ -73,10 +71,39 @@ auth` + the LFX/stack repair commit:
   startup sync deploys `backend/flows` to LFX, `uv run pytest` 60 green.
   Before Reopen in Container: `docker compose down` any manual stack
   (same project name → port clash).
+## 0.2 Phases 1–4 (done, with deviations)
 
-## 1. Locked decisions (do not re-ask)
+* Phase 1 auth as planned (`app/auth/*`, migration `a3f1c9e2b4d7`).
+  Additionally fixed: `settings.database_url` default is a real
+  `sqlite:///` URL (bare path crashed `create_engine`/alembic).
+* Phase 2: `CustomInputForm` has the 10 planned inputs **plus one hidden
+  `form_values: MessageTextInput (show=False)` plumbing input**. Without
+  it, submitted web-form values never reached the run (LFX routes run
+  input to entry nodes; scalar fields are not connectable). Fixture flow
+  `intake_form.json`: `ChatInput → form.form_values`,
+  `form.form_data → ChatOutput`; `collect()` merges the envelope
+  (`{"payload": {...}}` unwrapped like the other components) over field
+  defaults. Verified live: run with values returns them in the output.
+* Phase 2 generator caveat: lfx 1.12.x `to_frontend_node()` **cannot
+  re-instantiate `MultiselectInput`** (emits `list`, constructor forbids
+  extras — their own builtin `SearXNGToolComponent` fails identically).
+  `kirche_node()` therefore replicates the pre-validation dict build and
+  appends the `code` field by hand. If a future lfx fixes this, simplify
+  back to plain `to_frontend_node()`.
+* Phase 3 as planned (`input_schema.py`, `FlowVersion.input_schema`,
+  migration `b7e2d4a1c9f3`, `GET input-schema`). Deviations: schema is
+  cached in `store.create_version` (single choke point: sync, import, API
+  all covered); parser skips `show: false` fields; enum-mismatched
+  defaults omitted; endpoint maps `InvalidError` → 404 too
+  (`get_latest_deployed_version` raises it, not `NotFoundError`).
+* Phase 4 as planned (`react-router-dom@7`, `@rjsf/core` +
+  `@rjsf/validator-ajv8` (v6), English routes, German labels,
+  `credentials: include`, old tab shell dropped). `FlowsTab.tsx` deleted;
+  `ApprovalsTab`/`AdminTab` reused inside Tasks/Admin pages. Verified:
+  `npm run build` green, routes + `/api` proxy return 200, served schema
+  validates under JSON-Schema Draft 7.
 
-* Auth: SMTP magic-link, 15-min single-use tokens (`secrets.token_urlsafe`,
+## 1. Locked decisions (do not re-ask)* Auth: SMTP magic-link, 15-min single-use tokens (`secrets.token_urlsafe`,
   store `sha256`, `used_at` set before session creation), session = opaque id
   in **DB table**, cookie `HttpOnly; Secure; SameSite=Lax; Path=/`.
   SMTP creds already in `.env` (`SMTP_HOST/PORT/USERNAME/PASSWORD`,