- Create core/oauth module with OAuthProvider enum and shared types
- Implement providers.rs with auth URLs, token exchange, user info endpoints
- Add routes for /auth/oauth/providers, /auth/oauth/{provider}, and callbacks
- Update login.html with OAuth button grid and dynamic provider loading
- Add OAuth config settings to config.csv with setup documentation and links
- Uses HTMX for login form, minimal JS for OAuth provider visibility
- Add email-read-pixel config parameter to enable/disable tracking
- Implement tracking pixel injection in HTML emails
- Add sent_email_tracking table with migration
- Create 4 new API endpoints:
- GET /api/email/tracking/pixel/{id} - serve pixel & record read
- GET /api/email/tracking/status/{id} - get email read status
- GET /api/email/tracking/list - list all tracked emails
- GET /api/email/tracking/stats - get aggregate statistics
- Store tracking data: read_at, read_count, IP, user_agent
- Integrate with send_email() to auto-inject pixel when enabled
New rules added:
- Two LLM work modes: Execution (fazer) vs Review (conferir)
- Rust code only in architecture.md (gbapp chapter)
- Scan and delete misplaced ALL_CAPS.md files
- HTMX-first: minimize JS, delegate to server
- Local assets only: no CDN references
- Documentation validation process for chapters
- No dead code: implement real code, never use _ prefix
- cargo audit must pass with 0 warnings
- diesel only, remove sqlx references
- Library consolidation guidance
