feat(web): add authenticated task BFF

[seonghobae]

Advances #209 as a dependency-ordered child of #223. This bounded slice adds authenticated Task create/list browser boundaries beneath a Project. It derives workspace authority only from Identity, validates the opaque UUIDv4 parent Project before dependency access, signs the exact Planning method/path, forwards no browser credential to Planning, fails closed on workspace/parent/schema/status mismatches, rejects duplicate or oversized Task collections, preserves tenant-indistinguishable missing-parent semantics, and exposes only browser-safe Task evidence.

Test-first RED starts at af185e9e42c7624418a05999266f63e4ba736b16, which required Task handlers before production implementation. The current implementation uses a separate planning-task-client.ts bounded boundary rather than extending the Goal/Project client further, and adds Next.js 15 dynamic GET/POST routes plus route-contract evidence.

Keep this PR Draft until #223 is integrated/rebased without destructive history and the unchanged exact head satisfies focused/full tests, CI/security/review/thread/live-base gates. This slice adds no workspace UI and does not close #209.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by #238 after verified complete non-force ancestry repair. Parent #223 advanced to #237 by ancestry only with zero file delta. #238 head 2d14b19d349348bc84e12165bdfc079a6848c7cd descends from both this exact head e3c54b2907e5e98ba78da553162055e17472ae75 and #237 head 724ef1fec75852c1afc2273c9c8f8b2ad0ae9abb, preserving this predecessor tree and five-file delta unchanged. No predecessor checks/reviews transfer.