Plan misstates location of existing cloudflare-api-token keychain check

[smartwatermelon]

Non-Blocking Review Concern: Plan misstates location of existing cloudflare-api-token keychain check

Source: pre-push whole-codebase review
Location: docs/plans/2026-04-19-caddy-forms-auth.md:418 (Task 6 Step 2)
Date: 2026-04-19

What was flagged

Task 6 Step 2 instructs the implementer to add the JWT keychain check "Near the existing keychain-entry check for cloudflare-api-token" inside caddy-setup.sh. There is no such check in caddy-setup.sh (verified via grep find-generic-password); the only keychain read happens in app-setup/templates/caddy-wrapper.sh:6-13. Future executor of this plan will land in the wrong file or no-op the step. Suggest tightening the plan to either (a) add both cloudflare-api-token and caddy-jwt-signing-key preflight checks fresh to caddy-setup.sh, or (b) move the JWT preflight into the wrapper alongside the existing CF check.

Context

This issue was automatically created from a non-blocking concern identified
during pre-push whole-codebase review. It was flagged for tracking.

---

Created by lib-review-issues.sh