feat: tasks app, security hardening, mobile fixes, iOS app shell

- Custom SQLite task manager replacing TickTick wrapper
- 73 tasks migrated from TickTick across 15 projects
- RRULE recurrence engine with lazy materialization
- Dashboard tasks widget (desktop sidebar + mobile card)
- Tasks page with project tabs, add/edit/complete/delete
- Security: locked ports to localhost, removed old containers
- Gitea Actions runner configured and all 3 CI jobs passing
- Fixed mobile overflow on dashboard cards
- iOS Capacitor app shell (Second Brain)
- Frontend/backend guide docs for adding new services
- TickTick Google Calendar sync re-authorized

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

services/trips/server.py

@@ -1958,6 +1958,11 @@ class TripHandler(BaseHTTPRequestHandler):
             self.handle_oidc_callback()
             return
 
+        # Health check (before auth)
+        if path == "/api/health":
+            self.send_json({"status": "ok"})
+            return
+
         # Protected routes
         if not self.is_authenticated():
             # Return JSON 401 for API requests, redirect for browser