v1: correctness fixes and test foundation

[san-rat]

Implements specs/v1-correctness-and-tests.md — fixes GAPS #3, #4, #6, #8, #10, #11, #12, #19, #21, #22.

What changed

• Timestamps: timestamptz migrations (001/002) + init.sql; JSON now carries UTC offsets, browsers render correct local times.
• DB constraints: CHECK on status/priority, 2000-char description cap (DB + validation), index on activity_events(created_at DESC).
• Pagination: GET /api/tasks?limit=&offset= (default 50, max 200) with X-Total-Count; activity feed ?limit=.
• Validation: PUT {} now 400s ("At least one field must be provided."); description cap enforced.
• UI: server validation details surfaced in the notice; Blocked card added to the summary grid.
• Tests: backend.IntegrationTests/ (Testcontainers Postgres+Redis; CRUD, 404s, 400s, cache hit vs miss, Redis-stopped fallback, dead activity-service) + Vitest/RTL frontend suite.
• CI: frontend lint job, integration-test job, compose stack-smoke job (health poll + create/read round-trip through nginx).
• Cleanups: stray .codex, boilerplate frontend README, k6 write-load script.

Verification

Locally green: 13 unit + 11 integration + 4 frontend tests, lint, compose configs, and a full stack round-trip through nginx (migrations applied to the dev volume, X-Total-Count and validation responses confirmed live).