Review: Clean registration flow for App Store resubmission

Verdict: APPROVED

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- Related to #290 (App Store rejection)
• [x] Repo -- ldraney/landscaping-assistant
• [x] User Story -- present, well-formed
• [x] Context -- thorough background on iPad rejection, SMTP config, CSS hide removal
• [x] File Targets -- 2 modify targets, 2 DO NOT touch targets
• [x] Feature Flag -- "none" (appropriate for UI link + doc update)
• [x] Acceptance Criteria -- 6 criteria
• [x] Test Expectations -- present, run command corrected to bundle exec rspec
• [x] Constraints -- present
• [x] Checklist -- present
• [x] Related -- present

Traceability

• [x] story:app-store-submission label -- "Submit and maintain iOS App Store listing (privacy declarations, review compliance, metadata)"
• [x] story note verified -- found in project-landscaping-assistant user-stories section
• [x] arch:keycloak label -- Architecture: Keycloak (OIDC auth for pal-enterprises)
• [x] arch note verified -- arch-keycloak note exists in pal-e-docs
• [x] Forgejo issue -- ldraney/landscaping-assistant#348, open

File Targets

• [x] app/views/sessions/new.html.erb -- verified: exists (1.4k, last modified Jun 6). Shows only a "Sign in" button with plant icon, no mention of registration. Issue accurately describes the gap.
• [x] docs/keycloak-setup.md -- verified: exists (21k, last modified Jul 25). Line 85 still says registration is CSS-hidden (#kc-registration { display: none !important; }). This is outdated -- the CSS hide rule has been removed from login.css. Issue correctly identifies this needs updating.
• [x] keycloak-theme/landscaping/login/resources/css/login.css (DO NOT touch) -- verified: no display: none rule targeting #kc-registration. Line 284 styles #kc-registration with text-align, margin, font -- visible and functional.
• [x] config/initializers/omniauth.rb (DO NOT touch) -- verified: handles callback routing. Sessions controller uses CrewMember.find_or_create_by! (line 33) for both login and registration.

Repo Placement

Dependencies

• Board item #1684 (done) -- issue #290 (original iPad Register button error). Predecessor, completed.
• Board item #1507 (done) -- pal-e-services#122 (Keycloak app-store-submission bug). Completed.
• Board item #1927 (validation) -- issue #324 (Keycloak account-email SMTP setup). In validation. Relevant because AC #4 requires email verification to work, but SMTP configuration is managed separately and should be functional by now.
• Board item #1940 (qa) -- issue #249 (Keycloak redirects to Tailscale URL instead of public domain). In QA. Could affect registration redirects if the same issue applies to the registration callback.
• No blocking dependencies for the core code changes (adding link + updating docs).

Acceptance Criteria

• AC 1-3: Directly testable via code inspection and integration tests. The sessions controller uses CrewMember.find_or_create_by! and redirects to root_path (which redirects logged-in users to work_queue_items_path).
• AC 4: Manual verification of SMTP. Depends on account-email story infrastructure (item #1927, in validation). Reasonable to verify here but not a code change.
• AC 5: Manual iOS testing. Reasonable verification step.
• AC 6: Doc accuracy check, directly verifiable.
• All criteria are assessable. AC 4-5 are manual validation steps, not code changes.

Blast Radius

• sessions/new.html.erb is the login page for all platforms (web, iOS via Turbo Native, Android). Adding a registration link affects all entry points.
• No other pal-enterprises apps share this login page -- change is scoped to landscaping-assistant.
• OmniAuth callback at sessions#create already handles first-time users via find_or_create_by!, so the registration callback path requires no controller changes.
• No sibling services have the same pattern to fix.

Decomposition Assessment

Recommendation