feat: tasks app, security hardening, mobile fixes, iOS app shell

- Custom SQLite task manager replacing TickTick wrapper
- 73 tasks migrated from TickTick across 15 projects
- RRULE recurrence engine with lazy materialization
- Dashboard tasks widget (desktop sidebar + mobile card)
- Tasks page with project tabs, add/edit/complete/delete
- Security: locked ports to localhost, removed old containers
- Gitea Actions runner configured and all 3 CI jobs passing
- Fixed mobile overflow on dashboard cards
- iOS Capacitor app shell (Second Brain)
- Frontend/backend guide docs for adding new services
- TickTick Google Calendar sync re-authorized

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mobile/icon.svg

@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1024 1024">
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0%" stop-color="#4F46E5"/>
+      <stop offset="100%" stop-color="#3B82F6"/>
+    </linearGradient>
+  </defs>
+  <rect width="1024" height="1024" rx="224" fill="url(#bg)"/>
+  <g transform="translate(512, 512) scale(1)" fill="none" stroke="white" stroke-linecap="round" stroke-linejoin="round">
+    <!-- Brain - left half -->
+    <path d="M-20 180 C-20 180 -140 160 -180 80 C-200 30 -190 -20 -160 -60 C-185 -90 -180 -140 -150 -170 C-120 -200 -80 -210 -50 -195 C-40 -230 -5 -250 30 -240 C55 -232 65 -210 65 -190" stroke-width="32"/>
+    <!-- Brain - right half -->
+    <path d="M20 180 C20 180 140 160 180 80 C200 30 190 -20 160 -60 C185 -90 180 -140 150 -170 C120 -200 80 -210 50 -195 C40 -230 5 -250 -30 -240 C-55 -232 -65 -210 -65 -190" stroke-width="32"/>
+    <!-- Center line -->
+    <line x1="0" y1="-200" x2="0" y2="180" stroke-width="28"/>
+    <!-- Left fold -->
+    <path d="M-170 20 C-120 10 -60 15 0 5" stroke-width="24"/>
+    <!-- Right fold -->
+    <path d="M170 20 C120 10 60 15 0 5" stroke-width="24"/>
+    <!-- Brain stem -->
+    <path d="M0 180 L0 240 C0 270 -20 280 -40 270" stroke-width="28"/>
+  </g>
+</svg>