feat: tasks app, security hardening, mobile fixes, iOS app shell

- Custom SQLite task manager replacing TickTick wrapper
- 73 tasks migrated from TickTick across 15 projects
- RRULE recurrence engine with lazy materialization
- Dashboard tasks widget (desktop sidebar + mobile card)
- Tasks page with project tabs, add/edit/complete/delete
- Security: locked ports to localhost, removed old containers
- Gitea Actions runner configured and all 3 CI jobs passing
- Fixed mobile overflow on dashboard cards
- iOS Capacitor app shell (Second Brain)
- Frontend/backend guide docs for adding new services
- TickTick Google Calendar sync re-authorized

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -5,10 +5,8 @@ services:
       dockerfile: Dockerfile
     container_name: platform-frontend-v2
     restart: unless-stopped
-    ports:
-      - "3211:3000"
     environment:
-      - ORIGIN=${PLATFORM_V2_ORIGIN:-http://localhost:3211}
+      - ORIGIN=${PLATFORM_V2_ORIGIN:-https://dash.quadjourney.com}
       - GATEWAY_URL=http://gateway:8100
       - IMMICH_URL=${IMMICH_URL}
       - IMMICH_API_KEY=${IMMICH_API_KEY}
@@ -16,6 +14,10 @@ services:
       - KARAKEEP_API_KEY=${KARAKEEP_API_KEY}
       - BODY_SIZE_LIMIT=52428800
       - TZ=${TZ:-America/Chicago}
+    networks:
+      default:
+      pangolin:
+        ipv4_address: 172.16.1.50
     depends_on:
       - gateway
 
@@ -53,6 +55,8 @@ services:
       - KARAKEEP_API_KEY=${KARAKEEP_API_KEY}
       - SPOTIZERR_URL=${SPOTIZERR_URL:-http://spotizerr-app:7171}
       - BUDGET_BACKEND_URL=http://budget-service:3001
+      - TASKS_BACKEND_URL=http://tasks-service:8098
+      - TASKS_SERVICE_API_KEY=${TASKS_SERVICE_API_KEY}
       - QBITTORRENT_HOST=${QBITTORRENT_HOST:-192.168.1.42}
       - QBITTORRENT_PORT=${QBITTORRENT_PORT:-8080}
       - QBITTORRENT_USERNAME=${QBITTORRENT_USERNAME:-admin}
@@ -72,6 +76,19 @@ services:
       - fitness-service
       - inventory-service
       - budget-service
+      - tasks-service
+
+  tasks-service:
+    build:
+      context: ./services/tasks
+      dockerfile: Dockerfile
+    container_name: platform-tasks-service
+    restart: unless-stopped
+    volumes:
+      - ./services/tasks/data:/app/data
+    environment:
+      - PORT=8098
+      - TZ=${TZ:-America/Chicago}
 
   trips-service:
     build: