Launch checklist

1. Create the owner account. Open Admin sign in, choose Create account, and enter your own email and a password of at least 8 characters. No profile details are stored. Check your inbox for the confirmation link and confirm before signing in. Creating an account does not grant admin access.
2. Grant the first admin through trusted controls. In the Lovable editor, open More → Users and find the confirmed owner email; copy its user ID. Open More → Database → Manage → SQL editor. A project owner or authorized editor can run the statement below, replacing only the quoted OWNER_USER_ID with that exact user ID. Never grant a role to an unconfirmed or unrecognized account. On mobile, use Chat mode → … → More, then choose Users or Database from the bottom section menu.

   insert into public.user_roles (user_id, role)
   select id, 'admin'::public.app_role
   from auth.users
   where id = 'OWNER_USER_ID'::uuid
     and email_confirmed_at is not null
   on conflict (user_id, role) do nothing;

   Alternatively, after confirming your account, tell this project's assistant the owner email and explicitly ask to grant its first admin role. This grant is performed through trusted project controls, never through the public app.

3. Verify access before launch. Sign in again and open Moderation. Confirm the listing queue and Inquiries & reports tab load. A normal account must see Access restricted instead, and signed-out visitors must be sent to sign-in. Do not deploy until the initial admin passes this check.
4. Review a real authorized submission. Upload genuine photos, check private receipt access, verify pending visibility, approve only accurate content, and test renewal, marking adopted, removal and expiry.
5. Check the inbox regularly. Inquiries and reports stay in the private admin inbox. Rejection reasons stay internal and are not automatically emailed. Define who monitors and follows up.
6. Configure owner forwarding before promising delivery. Set up a sender domain you own, verify it, wire forwarding to the private listing contact, and test actual delivery. Until then retain the admin-inbox notices. This checklist does not configure email.
7. Supply the authentic Rancho Grande banner. Replace the current illustration with your prepared photo when uploaded. Do not use fabricated animal listings.
8. Confirm privacy and safety operations. Remove contact details and home addresses from public text/photos. Decide your contact-retention practice and removal process. Check storage stays private, rate limits and a strong private network-hashing salt.
9. Check mobile, keyboard and failed submissions. Confirm forms are legible, validation is clear, and private contacts never appear in public pages.
10. Publish only after explicit approval. Review access settings and the final hosted address before sharing it.