feat: tasks app, security hardening, mobile fixes, iOS app shell

- Custom SQLite task manager replacing TickTick wrapper
- 73 tasks migrated from TickTick across 15 projects
- RRULE recurrence engine with lazy materialization
- Dashboard tasks widget (desktop sidebar + mobile card)
- Tasks page with project tabs, add/edit/complete/delete
- Security: locked ports to localhost, removed old containers
- Gitea Actions runner configured and all 3 CI jobs passing
- Fixed mobile overflow on dashboard cards
- iOS Capacitor app shell (Second Brain)
- Frontend/backend guide docs for adding new services
- TickTick Google Calendar sync re-authorized

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend-v2/src/app.css

@@ -12,6 +12,8 @@
    ═══════════════════════════════════════════════ */
 
 @layer base {
+  html, body { overflow-x: hidden; }
+  body { padding-top: env(safe-area-inset-top); padding-bottom: env(safe-area-inset-bottom); }
   :root {
     /* ── Fonts ── */
     --font: 'Inter', -apple-system, system-ui, sans-serif;
@@ -457,5 +459,6 @@
   }
   .page-greeting { font-size: var(--text-xl); }
   .page { padding: var(--sp-5) 0 var(--sp-20); }
-  .app-surface { padding: 0 var(--sp-5); }
+  .app-surface { padding: 0 var(--sp-5); max-width: 100vw; box-sizing: border-box; }
+  .module, .module.primary, .module.flush { box-sizing: border-box; max-width: 100%; overflow: hidden; }
 }