Make the inbox global instead of per-project

A card either sits in its owner's inbox (project_id AND status_id both NULL)
or belongs to exactly one project with a status in it (both set) -- enforced
by a CHECK constraint, never one without the other. The inbox is global to a
user now, not per-project: cards can move from a project into the inbox and
back into any status column of any project.

Backend
- migrations/009: rebuilds `cards` (SQLite can't relax NOT NULL / add a CHECK
  in place) with a nullable project_id, a new owner_id (cards need direct
  ownership once they can have no project), and the CHECK constraint. Cards
  that had no status (the old per-project inbox) move to the new global inbox.
  status_id's FK is now ON DELETE RESTRICT, not SET NULL -- nulling it alone
  would violate the invariant, and there's no status-delete endpoint anyway.
- CardRepository: "column" is now (owner_id, project_id, status_id); every
  method that dealt with a project's columns is generalised to also cover the
  inbox and cross-project moves (orderColumn, idsInColumn, repack, ...).
- CardController/routes: single-card and ordering routes move to global,
  since a card may have no project to nest them under --
  GET/PATCH/DELETE /api/cards/{id}, PUT /api/cards/order (body now takes
  project_id + status_id, both null for the inbox). New GET/POST
  /api/inbox/cards. PATCH no longer accepts status_id -- moving a card, in or
  out of a project, is exclusively PUT /api/cards/order now. A card created
  directly in a project (POST /api/projects/{id}/cards) lands in its first
  status, since a project card can't have no status.
- Tests: ProjectTest/CardStatusTest updated for the new routes; CardOrderTest
  rewritten with full inbox/cross-project coverage. 57 tests pass.

Frontend
- New stores/inbox.ts (the global inbox) and lib/cardOrder.ts (the shared
  PUT /api/cards/order call, used by both the sidebar and a project's board).
- AppSidebar: an Inbox section under the project list -- a vuedraggable list
  in the same "kanban" drag group as every project's kanban columns, so a
  card drags straight from the sidebar into whichever project is open, or
  back out. (The empty-inbox state needed a real bugfix: it wasn't rendering
  a <draggable> at all, so there was nowhere to drop a card back into an
  empty inbox.) A drop reloads the inbox and, if a project is open, its cards.
- ProjectView's kanban board drops its synthetic Inbox column -- just the
  real statuses now.
- DashboardView simplified to a plain grid of project tiles (name + card
  count); its per-project "New" section is gone, since a project card can no
  longer have no status.
- stores/cards.ts: patch/remove move to the global /api/cards/{id} routes.

Verified end-to-end against the rebuilt container (existing per-project-inbox
cards correctly migrated to the global inbox, 0 invariant violations) and the
dev server via headless Chrome: sidebar inbox -> project A "To do" -> back to
inbox -> project B "Done", full journey confirmed via the API at each step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/README.md

@@ -33,11 +33,13 @@ src/main.ts             App bootstrap; resolves the stored session before mount
 src/router/index.ts     Routes + guard (redirects to /login when unauthenticated)
 src/stores/auth.ts      Pinia store: token in localStorage, magic-link + fetchMe
 src/stores/projects.ts  Pinia store: the user's projects (fetch + create)
-src/stores/cards.ts     Pinia store: one project's cards (CRUD + reorderColumn)
+src/stores/cards.ts     Pinia store: one project's cards (CRUD; no reordering -- see lib/cardOrder.ts)
+src/stores/inbox.ts     Pinia store: the caller's global inbox (fetch + create)
 src/lib/api.ts          fetch wrapper, bearer token, typed ApiError
-src/components/AppSidebar.vue left nav: Dashboard link, divider, project list + new-project form
+src/lib/cardOrder.ts    reorderColumn() -- PUT /api/cards/order, shared by the sidebar and kanban board
+src/components/AppSidebar.vue left nav: Dashboard link, project list + form, Inbox + form
 src/components/CardRow.vue    editable text + status chip + delete, one card
-src/components/KanbanCard.vue small draggable card for the board columns
+src/components/KanbanCard.vue small draggable card for the board columns and the inbox
 src/views/              DashboardView, ProjectView, LoginView, ProfileView,
                         VerifyEmailView
 ```
@@ -45,15 +47,27 @@ src/views/              DashboardView, ProjectView, LoginView, ProfileView,
 Signed-in "app" routes (`meta.requiresAuth`) render inside a persistent shell:
 the top bar, then a left **sidebar** (`AppSidebar.vue`) beside the routed view.
 The sidebar stays mounted across navigation — it holds a **Dashboard** link, a
-divider, the project list, and a compact new-project form (creating one jumps to
-it). The current page is highlighted via RouterLink's `active-class`.
-`<RouterView :key="route.path">` remounts the view on every path change so
-sidebar → project → project navigation always does a fresh load.
+divider, the project list + new-project form, another divider, then the
+**Inbox** (see below). The current page is highlighted via RouterLink's
+`active-class`. `<RouterView :key="route.path">` remounts the view on every
+path change so sidebar → project → project navigation always does a fresh load.
 
-`/` redirects to `/dashboard` (`DashboardView.vue`), a full-width grid of
-project cards — each shows the project name and, under a **New** heading, its
-inbox cards (`status_id === null`), fetched per project. Signed-out routes
-(`/login`, `/verify-email`) render without the sidebar.
+`/` redirects to `/dashboard` (`DashboardView.vue`), a full-width grid linking
+to each project, showing its title and card count. Signed-out routes (`/login`,
+`/verify-email`) render without the sidebar.
+
+## Inbox
+
+A card with no project lives in the caller's inbox (`useInboxStore`), rendered
+in the sidebar under the project list -- not per-project, and not tied to
+whatever page is open. It's a `vuedraggable` list in the same `"kanban"` drag
+group as every project's kanban columns (below), so a card can be dragged
+straight out of the sidebar into any status column of whichever project is
+currently open, or the other way. `AppSidebar`'s `onInboxChange` persists a
+drop via `reorderColumn(null, null, ids)`, then reloads the inbox and, if a
+project view is currently mounted (`route.name === 'project'`), that project's
+cards too -- either side of a drag could have been the inbox. A small form
+under the list adds a card straight to the inbox.
 
 ## Project detail
 
@@ -76,18 +90,18 @@ delete button.
 
 ### Kanban
 
-Columns, left to right: **Inbox** (cards with no status) then each project
-status in `position` order. `board` is derived from `cards.cards` + the
-project's statuses and rebuilt by a `watch` whenever either changes.
+One column per project status, in `position` order -- the inbox is *not* a
+column here; it's in the sidebar (see above), though it's still a valid drag
+source/target. `board` is derived from `cards.cards` + the project's statuses
+and rebuilt by a `watch` whenever either changes.
 
 Every drop — whether reordering within a column (`moved`) or dragging in from
-another (`added`) — calls `cards.reorderColumn(column.statusId, ids)` →
-`PUT /api/projects/:id/cards/order` with `{ status_id, card_ids }`. The server
-re-parents any moved-in card, re-packs the source column, and returns the whole
-project's cards, which replaces local state; on failure the board reloads.
-
-The Inbox column has a small name + **Add** form at the bottom (`cards.add`);
-new cards have no status, so they land straight in it.
+another column or the sidebar's inbox (`added`) — calls
+`reorderColumn(projectId, column.statusId, ids)` from `lib/cardOrder.ts` (shared
+with the sidebar) → `PUT /api/cards/order`. The server re-parents any moved-in
+card and re-packs whatever column it left; afterwards the view always reloads
+both `inbox` and this project's `cards`, since either could have been the other
+side of the move.
 
 ## Auth flow