High-level, prioritized view. Individual scheduled items live in the Milestones and Backlog databases below — this page is the narrative summary.

Now

• Add rate limiting to the admin login endpoint (security, highest priority — see the git repo's docs/security/rate-limiting.md)
• Fix the homepage double-fetch (performance — see docs/architecture/rendering-strategy.md)

Next

• Add minimal CI (lint + typecheck on PR) — see docs/deployment/ci-cd.md
• Remove unused dependencies (three.js/R3F, next-themes, axios, express-validator, multer)
• Extract shared useAdminResource/useToast hooks

Later

• Decide on Cloudinary: build it for real, or formally drop it from env docs
• Decide on JWT storage: localStorage vs. httpOnly cookie + CSRF (write an ADR first)
• Add real monitoring/analytics (currently none)

Full technical detail and rationale for every item above: see the git repo, docs/architecture/future-architecture.md and docs/appendices/technical-debt-register.md.