docs(use-cases): add registration, summarize-mode, landing scenarios

The .feature spec lagged shipped behaviour. Added three files, no
duplication of existing scenarios:
- registration.feature: new Dex subject -> registration gate (users +
  user_identities), returning subject straight through, account delete
  is tapir-side only and leaves other users intact, clean
  re-registration (ADR-012, ADR-013).
- summarize_mode.feature: auto summarizes every new video; manual
  (default) leaves them unsummarized until queued; queued video is
  processed and the flag cleared (migration 006).
- landing_page.feature: unauthenticated / -> /welcome, Get Started for
  guests, summary link + logout for authed users, logout -> /welcome.

Scoped to built features only — no Vimeo/Whisper/billing scenarios.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/use-cases/landing_page.feature

@@ -0,0 +1,28 @@
+Feature: Public landing page
+  As a first-time visitor
+  I want a public welcome page before I log in
+  So that I understand what Tapir is and how to get started without hitting a login wall
+
+  Scenario: An unauthenticated visit to the root is sent to the welcome page
+    Given I am not logged in
+    When I open the root path "/"
+    Then I am redirected to "/welcome"
+
+  Scenario: The welcome page invites an unauthenticated visitor to start
+    Given I am not logged in
+    When I open "/welcome"
+    Then I see a "Get Started" call to action
+
+  Scenario: An authenticated user on the welcome page sees their way in and out
+    Given I am logged in
+    When I open "/welcome"
+    Then I see a link to my summaries
+    And I see a way to log out
+
+  Scenario: Logging out returns to the welcome page
+    Given I am logged in
+    When I log out
+    Then I am returned to "/welcome"
+
+  # /welcome is mounted outside the auth guard so it is reachable without a session;
+  # the root and all data routes stay behind it (commits around the WelcomePage work).

docs/use-cases/registration.feature

@@ -0,0 +1,45 @@
+Feature: Register and manage a multi-user account
+  As one of a handful of trusted users
+  I want my own account, isolated from everyone else's
+  So that Tapir can serve several people from one deployment without leaking data
+
+  # Stage 1 (ADR-012): Dex authenticates, Tapir authorizes per user. A Dex subject
+  # with no users row is a new user and must register before reaching any data.
+
+  Scenario: A new Dex subject is routed to registration
+    Given I am authenticated by Dex with a subject that has no Tapir account
+    When I open any page that requires an account
+    Then I am routed to the registration page
+    And no summaries are shown until I register
+
+  Scenario: Registering creates the account and its identity mapping
+    Given I am authenticated by Dex with a subject that has no Tapir account
+    When I complete registration
+    Then a user row is created for me
+    And a user_identities row maps my Dex subject to that user
+    And I am taken into the app as a registered user
+
+  Scenario: A returning subject passes straight through
+    Given I am authenticated by Dex with a subject that already has a Tapir account
+    When I open the app
+    Then I am not asked to register again
+    And I see my own summaries
+
+  Scenario: Deleting an account removes only my data and leaves other users untouched
+    Given I am a registered user with summaries, a connected account, and recorded actions
+    And another user exists with their own summaries
+    When I delete my account
+    Then all of my rows are removed across every user-owned table
+    And my stored secret references are removed
+    And the other user's data remains intact
+    And my Dex identity is left intact
+
+  Scenario: A deleted user can register again as a fresh account
+    Given I deleted my Tapir account but my Dex identity still exists
+    When I sign in again
+    Then I am routed to the registration page as a new user
+    And registering creates a fresh user row with none of my old data
+
+  # Isolation is DB-enforced (Postgres RLS, ADR-012, migration 003): a user can never
+  # read or write another user's rows even if an application WHERE clause is wrong.
+  # Deletion is Tapir-side only — the shared Dex directory is never modified (ADR-013).

docs/use-cases/summarize_mode.feature

@@ -0,0 +1,32 @@
+Feature: Choose how new videos get summarized
+  As a user who wants control over compute and noise
+  I want to pick whether new videos are summarized automatically or on demand
+  So that I only spend summarization on the videos I actually care about
+
+  Background:
+    Given I am a registered user with a connected video account
+
+  Scenario: Auto mode summarizes every new video
+    Given my summarization mode is "auto"
+    When a subscribed channel posts a new video with captions
+    Then Tapir summarizes it without my asking
+    And the summary appears in my list
+
+  Scenario: Manual mode is the default and leaves new videos unsummarized
+    Given I have not changed my summarization mode
+    Then my mode is "manual"
+    When a subscribed channel posts a new video with captions
+    Then the video appears in my list with no summary
+    And nothing is summarized until I request it
+
+  Scenario: Requesting a summary in manual mode queues it for the next run
+    Given my summarization mode is "manual"
+    And a new video is in my list with no summary
+    When I click "Summarize" on that video
+    Then the video is marked as requested
+    And the next run summarizes it
+    And the request flag is cleared after it is processed
+
+  # auto_summarize is a per-user setting and summarize_requested is a per-video queue
+  # flag (migration 006). The web button sets the flag; `tapir run` processes both the
+  # auto videos and the manually queued ones, then clears the flag.