future-plans: multi-user, team permissions, shared auth library

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

future-plans.md

@@ -209,6 +209,33 @@ This would allow:
 - Unit conversion on query (e.g. `temp > 200K` matching a stored `-73°C`)
 - Catching unit mismatches at entry time
 
+## Multi-user and access control
+
+### Multi-user support
+Currently single-user with no authentication. For shared/team use:
+- User accounts with login (session or token-based)
+- Per-user audit trail (who added/changed what, ties into delta tracking)
+- Optional: user-specific preferences (display units, default grid, etc.)
+
+### Team / permission model
+Teams or roles controlling what users can do:
+- Read-only members (view inventory, no edits)
+- Contributors (add/edit components and inventory)
+- Admins (manage fields, grids, users)
+- Possible per-resource permissions (e.g. a team owns a specific grid)
+
+### Common user/team library
+User and team management is a recurring need across projects. Should be extracted
+into a shared library (alongside the planned kv-store library) rather than
+reimplemented per project. The library would provide:
+- User CRUD with hashed credentials
+- Session/token management
+- Role and permission primitives
+- Middleware for Express (protect routes by role)
+
+The electronics inventory would then depend on this library rather than rolling its
+own auth. Other projects (`publication-tool`, future apps) would do the same.
+
 ## Deployment
 
 ### Read-only public mode