feat: tasks app, security hardening, mobile fixes, iOS app shell

- Custom SQLite task manager replacing TickTick wrapper
- 73 tasks migrated from TickTick across 15 projects
- RRULE recurrence engine with lazy materialization
- Dashboard tasks widget (desktop sidebar + mobile card)
- Tasks page with project tabs, add/edit/complete/delete
- Security: locked ports to localhost, removed old containers
- Gitea Actions runner configured and all 3 CI jobs passing
- Fixed mobile overflow on dashboard cards
- iOS Capacitor app shell (Second Brain)
- Frontend/backend guide docs for adding new services
- TickTick Google Calendar sync re-authorized

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

gateway/dashboard.py

@@ -188,7 +188,7 @@ def handle_dashboard(handler, user):
     conn.close()
 
     # Services that use gateway-injected API keys (not per-user tokens)
-    GATEWAY_KEY_SERVICES = {"inventory", "reader", "books", "music", "budget"}
+    GATEWAY_KEY_SERVICES = {"inventory", "reader", "books", "music", "budget", "tasks"}
     widgets = []
     futures = {}