feat: tasks app, security hardening, mobile fixes, iOS app shell

- Custom SQLite task manager replacing TickTick wrapper
- 73 tasks migrated from TickTick across 15 projects
- RRULE recurrence engine with lazy materialization
- Dashboard tasks widget (desktop sidebar + mobile card)
- Tasks page with project tabs, add/edit/complete/delete
- Security: locked ports to localhost, removed old containers
- Gitea Actions runner configured and all 3 CI jobs passing
- Fixed mobile overflow on dashboard cards
- iOS Capacitor app shell (Second Brain)
- Frontend/backend guide docs for adding new services
- TickTick Google Calendar sync re-authorized

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/README.md

@@ -8,14 +8,26 @@ Runs on push/PR to `master`. Three jobs:
 2. **secret-scanning** — checks for tracked .env/.db files and hardcoded secret patterns
 3. **dockerfile-lint** — verifies all Dockerfiles have `USER` (non-root) and `HEALTHCHECK`
 
-## Prerequisites
+## Runner Setup
 
-These workflows require a **Gitea Actions runner** to be configured.
-Without a runner, the workflows are committed but will not execute.
+The runner is configured in the Gitea docker-compose at `/media/yusiboyz/Media/Scripts/gitea/docker-compose.yml`.
 
-To set up a runner:
-1. Go to Gitea → Site Administration → Runners
-2. Register a runner (Docker-based or shell-based)
-3. The workflows will automatically execute on the next push
+**What was done:**
+1. Added `[actions] ENABLED = true` to Gitea's `app.ini`
+2. Added `runner` service (gitea/act_runner) to Gitea's docker-compose
+3. Generated runner token via `docker exec -u git gitea gitea actions generate-runner-token`
+4. Token stored in `/media/yusiboyz/Media/Scripts/gitea/.env` as `RUNNER_TOKEN`
+5. Runner registered as `platform-runner` with labels: ubuntu-latest, ubuntu-24.04, ubuntu-22.04
 
-See: https://docs.gitea.com/usage/actions/overview
+**To regenerate token (if needed):**
+```bash
+cd /media/yusiboyz/Media/Scripts/gitea
+docker exec -u git gitea gitea actions generate-runner-token
+# Update .env with new RUNNER_TOKEN value
+docker compose up -d runner
+```
+
+**To check runner status:**
+```bash
+docker logs gitea-runner
+```

.gitea/workflows/security.yml

@@ -5,6 +5,7 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+  workflow_dispatch:
 
 jobs:
   dependency-audit: