Build a secure multi-firm client management web app (Apex CRM pilot MVP)

Apex CRM is a client management product for professional services firms (law, accounting and financial advisory). We have a front-end shell (installable web app, responsive for phone and desktop, offline page, service worker) but no server, database or login, so data only lives in the browser. We need the smallest working version that one firm can use for a 60-day pilot. MUST HAVE 1. Accounts and login: email and password sign-up and sign-in. Passwords hashed with Argon2, bcrypt or PBKDF2 with a high iteration count. Sign out. Stay signed in across phone and desktop. 2. Firms (multi-tenant): each firm's data is private. A user from one firm must never see another firm's data. Explain how you enforce this. 3. Users and roles: an Admin can invite Members by email. Roles: Admin and Member. 4. Clients: add, edit, search and delete. Fields: name, firm or company, email, phone, address, notes, tags or status. Search by name and company. 5. Notes and history: dated notes on each client, showing who wrote it and when. History stays with the firm, not the individual user. 6. Works on phone and desktop: responsive, installable as a web app, data synced through the server. 7. Basic audit trail: record who created, changed or deleted a record and when. Admin can view it. 8. Hosting and security basics: HTTPS only. Data in an Australian region if the host offers one (say so if it does not). No secrets in front-end code. Daily backups. OUT OF SCOPE (do not quote for): billing and subscriptions, tiers, TOTP and device fingerprint login, SAML single sign-on, live location sync, push notifications, public API, offline write queue, native app store apps. ACCEPTANCE TESTS 1. Sign up as a new firm; the user becomes Admin. 2. Add a client with all fields. 3. Add a note and see it in the client's history. 4. Search for the client by name. 5. Sign out and back in on a phone and see the same data. 6. Invite a Member, who signs in and sees the firm's clients. 7. Sign up as a second, different firm; it cannot see the first firm's clients. 8. Delete a client; it is gone and the action appears in the audit trail. DELIVERABLES A live HTTPS URL to test. Full source code in a repository owned by the client, with a short README (how to run, deploy and back up). Admin access to the hosting and database accounts, in the client's name. A short written note on how data is separated between firms and how passwords are stored. OWNERSHIP The client owns all code and work product. The developer signs a confidentiality agreement before seeing the full shell files. No reuse or resale of the code. WHAT APPLICANTS SHOULD INCLUDE Similar apps they have built (links). The stack they would use and why. How they would keep each firm's data separate. Fixed price and timeline split into milestones (suggested: 1 login, firms and users; 2 clients and notes; 3 sync, audit trail and polish). When they can start. Applicants should state their own timeline; no target date has been set. BUDGET Up to AUD 1,200, fixed price, paid by milestone through the platform's milestone payment option. If the full scope does not fit, applicants should quote the smallest version first (login, firms, clients and notes) and price invites and the audit trail as a second stage. Applicants message through the platform.