Harden API, data layer, and autosave; add validation, pagination, migrations

- Enforce task ownership on PATCH/DELETE /api/tasks (was: any signed-in
  user could edit or delete anyone's tasks)
- Validate all API request bodies with zod; escape user content and
  restrict links to http(s) in the Drive export; block reverting a
  SUBMITTED report
- Add @@unique([userId, date]) on Report with upsert to eliminate the
  duplicate-daily-report race; switch startup from
  `prisma db push --accept-data-loss` to `prisma migrate deploy` with
  automatic baselining of existing databases (dedup migration merges
  any pre-existing duplicates)
- Autosave: re-queue and retry failed task saves with a visible
  saving/error indicator instead of silently dropping edits
- Paginate and filter GET /api/reports (?date, ?mine, ?q, ?take,
  ?cursor); report form fetches only today's report, admin dashboard
  uses server-side search + Load more
- Type the frontend and lib layer (DTOs in src/types/api.ts); zero
  eslint errors
- Update README and Unraid guide for migrations, upgrade path, and API

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

entrypoint.sh

@@ -1,6 +1,15 @@
 #!/bin/sh
 set -e
-echo "Running prisma db push..."
-npx prisma db push --accept-data-loss
+
+echo "Applying database migrations..."
+if ! npx prisma migrate deploy; then
+  # An existing database from the old `db push` days has tables but no
+  # migration history (P3005). Baseline it: mark the init migration as
+  # already applied, then deploy the rest.
+  echo "Migrate deploy failed - attempting to baseline existing database..."
+  npx prisma migrate resolve --applied 0_init
+  npx prisma migrate deploy
+fi
+
 echo "Starting server..."
 node server.js