["### US-001: Email Validation Registration\nPriority: P1\nDescription: As a new user, I want to register with email validation so that legitimate users are verified before accessing the system.\n\nAcceptance Criteria:\n- [ ] User can register with email, username, password, full name\n- [ ] Email validation email contains unique validation token\n- [ ] Token expires after 24 hours\n- [ ] User cannot log in until email is validated\n- [ ] Resend validation email option available\n- [ ] Email service uses Resend or SendGrid\n- [ ] Validation flow prevents multiple accounts per email\n- [ ] Frontend shows appropriate states (pending/validated/resend)\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-002: User Login with JWT Tokens\nPriority: P1\nDescription: As a registered user, I want to log in with email and password to receive JWT access and refresh tokens so I can access protected resources.\n\nAcceptance Criteria:\n- [ ] Login accepts email and password\n- [ ] Returns JWT access token (expires 15 minutes)\n- [ ] Returns JWT refresh token (expires 7 days) with secure httpOnly cookie\n- [ ] Password hashing uses bcrypt with cost factor 12\n- [ ] Failed login attempts are rate limited (5 attempts per IP per hour)\n- [ ] Account lockout after 10 failed attempts\n- [ ] Access token used for API requests (Authorization header)\n- [ ] Refresh token used to obtain new access tokens\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-003: Password Reset Flow\nPriority: P2\nDescription: As a user, I want to reset a forgotten password via email so I can regain access to my account.\n\nAcceptance Criteria:\n- [ ] User can request password reset with registered email\n- [ ] Reset token expires after 1 hour\n- [ ] Reset email contains secure link with token\n- [ ] Reset link must be used (cannot be reused)\n- [ ] Old password is immediately invalidated\n- [ ] Strong password validation enforced\n- [ ] Reset confirms success and prompts login\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-004: User Profile Management\nPriority: P2\nDescription: As a registered user, I want to update my profile information, notification preferences, and display settings so my experience is personalized.\n\nAcceptance Criteria:\n- [ ] User can update full name, username, email\n- [ ] Email change requires re-validation\n- [ ] User can set notification preferences (race completed, draft turn, invitations, team updates, points updated)\n- [ ] User can select theme preference (light, dark, system)\n- [ ] User can select language preference\n- [ ] User can set timezone preference\n- [ ] Profile visibility setting (public/private)\n- [ ] Show email to league members option\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-005: Auto-Pick Configuration\nPriority: P3\nDescription: As a team owner, I want to configure auto-pick settings for my team so if I miss my draft turn, the system picks based on my strategy.\n\nAcceptance Criteria:\n- [ ] User can enable/disable auto-pick\n- [ ] Multiple pick strategies available (highest_ranked, most_points, best_value)\n- [ ] Auto-pick triggers when timer expires\n- [ ] Auto-pick respects budget constraints\n- [ ] Auto-pick respects availability (already picked)\n- [ ] User can override auto-pick if present\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-006: List and Search Leagues\nPriority: P1\nDescription: As a user, I want to browse and search for public leagues so I can find interesting leagues to join.\n\nAcceptance Criteria:\n- [ ] List all public leagues with pagination (default 20 per page)\n- [ ] Search leagues by name with fuzzy matching\n- [ ] Filter by number of teams (shows full/available leagues)\n- [ ] Show league info (name, member count, creator, privacy)\n- [ ] Sort by most recent, most members, name\n- [ ] Private leagues only visible to members\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-007: Join League via Code\nPriority: P1\nDescription: As a user, I want to join a private league using a 6-character code so I can participate with my friends.\n\nAcceptance Criteria:\n- [ ] Enter 6-character league code (case-insensitive)\n- [ ] Verify league exists and is joinable\n- [ ] Check league hasn't reached max teams (2-10)\n- [ ] Check user doesn't already have a team in the league\n- [ ] For private leagues, verify invitation exists or creator allows\n- [ ] On success, create fantasy team in league\n- [ ] User becomes league member (default member role)\n- [ ] Create activity log entry for league\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-008: Create Fantasy League\nPriority: P1\nDescription: As a user, I want to create a fantasy league so I can invite friends and compete in fantasy F1.\n\nAcceptance Criteria:\n- [ ] Create league with name, description\n- [ ] Generate unique 6-character league code\n- [ ] Set league size (2-10 teams)\n- [ ] Set league privacy (private/public)\n- [ ] Set scoring rules (customizable JSON config)\n- [ ] Upload league avatar (optional)\n- [ ] Choose draft method (manual, snake, random)\n- [ ] Set draft close condition (FP1, FP2, FP3, qualifying, manual)\n- [ ] Set scheduled draft date/time\n- [ ] Set pick timer (default 60 seconds)\n- [ ] Creator becomes league admin\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-009: Send League Invitations\nPriority: P1\nDescription: As a league admin, I want to invite users via email, username, or user ID so I can grow my league.\n\nAcceptance Criteria:\n- [ ] Invite via email (send invitation to email address)\n- [ ] Invite via username (search user by username)\n- [ ] Invite via user ID (direct invite if known)\n- [ ] Generate unique invite code for email invitations\n- [ ] Set invitation expiration (default 7 days)\n- [ ] Include optional custom message\n- [ ] Track invitation status (pending, accepted, rejected, expired)\n- [ ] Limit total invitations per league (prevent spam)\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-010: Accept/Reject League Invitations\nPriority: P1\nDescription: As a user, I want to accept or reject league invitations so I can control which leagues I join.\n\nAcceptance Criteria:\n- [ ] View received invitations with league details\n- [ ] Accept invitation to join league (creates fantasy team)\n- [ ] Reject invitation to decline join\n- [ ] View invitation status (pending, accepted, rejected)\n- [ ] Filter invitations by status\n- [ ] Expired invitations show as expired\n- [ ] Activity log tracks accept/reject actions\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-011: Manage League Roles\nPriority: P2\nDescription: As a league admin, I want to manage member roles (admin, member) so I can enforce access control.\n\nAcceptance Criteria:\n- [ ] List all league members with roles\n- [ ] Promote member to admin (requires existing admin permission)\n- [ ] Demote admin to member (requires existing admin permission)\n- [ ] League creator always remains admin\n- [ ] Minimum one admin required in league\n- [ ] Activity log tracks role changes\n- [ ] Only admins can modify roles\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-012: Create Draft Order\nPriority: P1\nDescription: As a league admin, I want to create the draft order for a race so the drafting process is defined.\n\nAcceptance Criteria:\n- [ ] Set draft method (sequential, snake, random, manual)\n- [ ] Sequential: fixed order Teams A-B-C-D, repeat\n- [ ] Snake: A-B-C-D-D-C-B-A pattern\n- [ ] Random: randomly shuffle team order\n- [ ] Manual: admin specifies exact order per round\n- [ ] Draft order stored per race (can vary by race)\n- [ ] Supports manual override of auto-generated order\n- [ ] Activity log tracks draft order changes\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-013: View Live Draft\nPriority: P1\nDescription: As a league member, I want to view the live draft so I can see what picks are happening in real-time.\n\nAcceptance Criteria:\n- [ ] Show current draft order with teams\n- [ ] Highlight whose turn it is to pick\n- [ ] Show pick timer countdown (default 60 sec)\n- [ ] Display already-picked drivers/constructors\n- [ ] Show draft progress (round X of Y, picks Z of total)\n- [ ] Real-time updates when picks are made (via WebSockets or polling)\n- [ ] Draft closes by configured condition (FP1, FP2, FP3, qualifying, manual)\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-014: Make Draft Pick\nPriority: P1\nDescription: As a team owner in my turn, I want to pick a driver for my team so I can build my roster.\n\nAcceptance Criteria:\n- [ ] Only pick when it's my turn (based on draft order)\n- [ ] View available drivers (not already picked)\n- [ ] View driver stats (price, team, performance)\n- [ ] Select driver to pick\n- [ ] Respect budget constraints (100M total)\n- [ ] Validate driver not already picked by any team\n- [ ] Pick recorded with timestamp and pick number\n- [ ] Auto-pick triggers if timer expires (if enabled)\n- [ ] Real-time notification of pick to all league members\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-015: Auto-Pick on Timer Expiry\nPriority: P1\nDescription: As a system, I want to auto-pick for absent team owners so the draft keeps moving.\n\nAcceptance Criteria:\n- [ ] Timer expiry triggers auto-pick if team owner absent\n- [ ] Auto-pick uses configured strategy (highest_ranked, most_points, best_value)\n- [ ] Auto-pick respects budget constraints\n- [ ] Auto-pick respects driver availability (not already picked)\n- [ ] Auto-pick triggers whenever timer expires in draft order\n- [ ] Notification sent to team owner when auto-pick occurs\n- [ ] Activity log records auto-pick event\n- [ ] Owner can view their auto-pick history\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-016: Create Fantasy Team\nPriority: P1\nDescription: As a user joining a league, I want to create my fantasy team so I can participate in drafting.\n\nAcceptance Criteria:\n- [ ] Team created automatically when accepting invitation or joining via code\n- [ ] Specify team name (unique within league)\n- [ ] Budget initialized to 100M\n- [ ] Owner is set to current user\n- [ ] League association enforced\n- [ ] Team starts empty (no picks until draft)\n- [ ] Activity log tracks team creation\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-017: View My Team Roster\nPriority: P1\nDescription: As a team owner, I want to view my drivers so I can track my roster.\n\nAcceptance Criteria:\n- [ ] Show all drafted drivers for my team\n- [ ] Display driver details: name, team, number, price, points\n- [ ] Show points earned per race\n- [ ] Show total points across all races\n- [ ] Show budget remaining\n- [ ] Show team total value (drivers selected)\n- [ ] Drivers sorted by pick order or points\n- [ ] Links to driver detail pages\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-018: View League Leaderboard\nPriority: P1\nDescription: As a league member, I want to view the leaderboard so I can track my ranking in the league.\n\nAcceptance Criteria:\n- [ ] Display all teams ranked by total points\n- [ ] Show ranking position (1st, 2nd, 3rd, etc.)\n- [ ] Show team name, owner, total points, budget\n- [ ] Highlight current user's team\n- [ ] Show points gap between positions\n- [ ] Sort by total points (descending)\n- [ ] Leaderboard updates in real-time as races complete\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-019: Browse Drivers\nPriority: P1\nDescription: As a user, I want to browse all F1 drivers with statistics so I can make informed draft decisions.\n\nAcceptance Criteria:\n- [ ] List all current season drivers (pagination)\n- [ ] Show driver details: name, number, team, code, country\n- [ ] Show driver stats: price, total points, wins, podiums, average finishing position\n- [ ] Show calculated stats: win rate, podium rate, retirement rate\n- [ ] Filter drivers by team\n- [ ] Search drivers by name\n- [ ] Sort by various metrics (points, price, win rate, etc.)\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-020: Browse Constructors (Teams)\nPriority: P1\nDescription: As a user, I want to browse F1 constructors so I can understand the team landscape.\n\nAcceptance Criteria:\n- [ ] List all constructors (pagination)\n- [ ] Show constructor details: team name, team code, engine, chassis\n- [ ] Show stats: world wins, world championships, current points\n- [ ] Show constructor price for fantasy drafting\n- [ ] Filter constructors by nationality\n- [ ] Search constructors by name\n- [ ] Sort by various metrics\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-021: View Race Schedule\nPriority: P2\nDescription: As a user, I want to view the F1 race schedule so I can plan around upcoming races.\n\nAcceptance Criteria:\n- [ ] List all races in current season (chronological order)\n- [ ] Show race details: name, circuit name, country, round number, date/time\n- [ ] Show session times: FP1, FP2, FP3, Qualifying, Sprint, Race\n- [ ] Display race status (upcoming, in progress, completed)\n- [ ] Timezone conversion based on user's timezone preference\n- [ ] Filter by race status\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n### US-022: View Race Results\nPriority: P1\nDescription: As a league member, I want to view race results so I can see how my drivers performed.\n\nAcceptance Criteria:\n- [ ] List race finishing order for completed races\n- [ ] Show driver finishing position, team, points earned\n- [ ] Show DNF (Did Not Finish) and DNS (Did Not Start) statuses\n- [ ] Highlight drivers in my fantasy teams\n- [ ] Calculate fantasy points earned based on scoring rules\n- [ ] Show fastest lap information\n- [ ] Typecheck passes\n- [ ] Verify in browser using webapp-testing skill\n\n---\n\nMore stories to follow: Admin panel, notifications, security, mobile UX, operations"]