Harden API, data layer, and autosave; add validation, pagination, migrations

- Enforce task ownership on PATCH/DELETE /api/tasks (was: any signed-in
  user could edit or delete anyone's tasks)
- Validate all API request bodies with zod; escape user content and
  restrict links to http(s) in the Drive export; block reverting a
  SUBMITTED report
- Add @@unique([userId, date]) on Report with upsert to eliminate the
  duplicate-daily-report race; switch startup from
  `prisma db push --accept-data-loss` to `prisma migrate deploy` with
  automatic baselining of existing databases (dedup migration merges
  any pre-existing duplicates)
- Autosave: re-queue and retry failed task saves with a visible
  saving/error indicator instead of silently dropping edits
- Paginate and filter GET /api/reports (?date, ?mine, ?q, ?take,
  ?cursor); report form fetches only today's report, admin dashboard
  uses server-side search + Load more
- Type the frontend and lib layer (DTOs in src/types/api.ts); zero
  eslint errors
- Update README and Unraid guide for migrations, upgrade path, and API

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

prisma/migrations/20260701000000_report_unique_user_date/migration.sql

@@ -0,0 +1,30 @@
+-- Deduplicate reports before adding the unique constraint:
+-- keep the earliest report per (userId, date), move tasks from the
+-- duplicates onto it, then delete the duplicates.
+
+UPDATE "Task"
+SET "reportId" = (
+    SELECT keep."id"
+    FROM "Report" keep
+    JOIN "Report" cur ON cur."id" = "Task"."reportId"
+    WHERE keep."userId" = cur."userId"
+      AND keep."date" = cur."date"
+    ORDER BY keep."createdAt" ASC, keep."id" ASC
+    LIMIT 1
+);
+
+DELETE FROM "Report"
+WHERE "id" IN (
+    SELECT "id" FROM (
+        SELECT "id",
+               ROW_NUMBER() OVER (
+                   PARTITION BY "userId", "date"
+                   ORDER BY "createdAt" ASC, "id" ASC
+               ) AS rn
+        FROM "Report"
+    )
+    WHERE rn > 1
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Report_userId_date_key" ON "Report"("userId", "date");