browser/openspec/changes/implement-role-scoped-server-access/tasks.md

1. Backend Model And Authorization

• 1.1 Add server owner/admin membership fields, DTOs, copy helpers, filters, and validators.
• 1.2 Update registration bootstrap so the first user becomes an authenticated platform administrator.
• 1.3 Add service authorization helpers for platform admin, server owner, and server administrator visibility.
• 1.4 Scope server list/detail/lifecycle HTTP APIs by bearer session and server ACLs.
• 1.5 Add owner APIs for listing invite candidates, inviting administrators, and removing administrators.

2. Frontend User Flow

• 2.1 Add API types and client methods for server membership and invite candidates.
• 2.2 Render owner/admin metadata and owner-only administrator management in server detail.
• 2.3 Ensure server-only users continue landing on and seeing only their server list/detail workspaces.

3. Verification

• 3.1 Add backend tests for bootstrap registration, server ACL visibility, lifecycle authorization, and owner membership changes.
• 3.2 Add frontend tests for role-scoped server UI and membership client behavior.
• 3.3 Run OpenSpec strict validation, structure checks, backend tests, frontend tests, and browser walkthrough.