Adds application design (awaiting approval)

aidlc-docs/features/cms-frontend/inception/requirements/requirements.md

@@ -34,6 +34,7 @@
 - If the user is not authenticated and tries to access a protected route, redirect to `/login`
 - Role-based guards MUST be applied per page:
   - System Settings page: Owner only
+  - CMS Management page: Owner only
   - User Management page: Owner and Admin
   - Profile page: Any authenticated user
   - Dashboard: Any authenticated user
@@ -75,6 +76,7 @@
   - Dashboard: all authenticated users
   - User Management: Owner and Admin
   - System Settings: Owner only
+  - CMS Management: Owner only (multi-CMS management feature; restricted from the start even though it is a placeholder in v1)
   - Profile: all authenticated users
   - Logout button: all authenticated users
 - Mobile-responsive: sidebar collapses on small screens
@@ -85,9 +87,10 @@
 - Default: system preference
 
 ### FR-12: CMS Management (Placeholder)
-- Page at `/cms` (structure ready, no real data)
-- Shows navigation structure for future CMS content modules
-- Clearly marked as "Work in Progress" with a placeholder message
+- Page at `/cms` accessible to **Owner only**
+- Non-Owner roles attempting to access `/cms` are redirected to an "Access Denied" page or back to `/`
+- Shows a "Work in Progress" placeholder describing that this section will allow managing multiple client CMS instances
+- CMS Management is NOT shown in the sidebar for Admin or User roles
 
 ---
 
@@ -140,7 +143,14 @@
 
 ### NFR-06: Input Validation (SECURITY-05)
 - All form inputs are validated client-side using react-hook-form before submission
-- Validation includes: required fields, email format, password minimum length (8+ chars), max lengths
+- Password fields enforce the **exact backend rules** (verified in `ServiceCollectionExtensions.cs`):
+  - Minimum length: **8 characters**
+  - At least **1 uppercase letter** (`RequireUppercase = true`)
+  - At least **1 lowercase letter** (`RequireLowercase = true`)
+  - At least **1 digit** (`RequireDigit = true`)
+  - At least **1 non-alphanumeric character** (`RequireNonAlphanumeric = true`, e.g. `!@#$%^&*`)
+- Inline per-rule validation messages indicate which specific rule is not yet met
+- Validation also includes: required fields, email format, max lengths
 - Server-side validation errors are displayed to the user without exposing internal details
 
 ### NFR-07: Access Control (SECURITY-08)