Make the inbox global instead of per-project

A card either sits in its owner's inbox (project_id AND status_id both NULL)
or belongs to exactly one project with a status in it (both set) -- enforced
by a CHECK constraint, never one without the other. The inbox is global to a
user now, not per-project: cards can move from a project into the inbox and
back into any status column of any project.

Backend
- migrations/009: rebuilds `cards` (SQLite can't relax NOT NULL / add a CHECK
  in place) with a nullable project_id, a new owner_id (cards need direct
  ownership once they can have no project), and the CHECK constraint. Cards
  that had no status (the old per-project inbox) move to the new global inbox.
  status_id's FK is now ON DELETE RESTRICT, not SET NULL -- nulling it alone
  would violate the invariant, and there's no status-delete endpoint anyway.
- CardRepository: "column" is now (owner_id, project_id, status_id); every
  method that dealt with a project's columns is generalised to also cover the
  inbox and cross-project moves (orderColumn, idsInColumn, repack, ...).
- CardController/routes: single-card and ordering routes move to global,
  since a card may have no project to nest them under --
  GET/PATCH/DELETE /api/cards/{id}, PUT /api/cards/order (body now takes
  project_id + status_id, both null for the inbox). New GET/POST
  /api/inbox/cards. PATCH no longer accepts status_id -- moving a card, in or
  out of a project, is exclusively PUT /api/cards/order now. A card created
  directly in a project (POST /api/projects/{id}/cards) lands in its first
  status, since a project card can't have no status.
- Tests: ProjectTest/CardStatusTest updated for the new routes; CardOrderTest
  rewritten with full inbox/cross-project coverage. 57 tests pass.

Frontend
- New stores/inbox.ts (the global inbox) and lib/cardOrder.ts (the shared
  PUT /api/cards/order call, used by both the sidebar and a project's board).
- AppSidebar: an Inbox section under the project list -- a vuedraggable list
  in the same "kanban" drag group as every project's kanban columns, so a
  card drags straight from the sidebar into whichever project is open, or
  back out. (The empty-inbox state needed a real bugfix: it wasn't rendering
  a <draggable> at all, so there was nowhere to drop a card back into an
  empty inbox.) A drop reloads the inbox and, if a project is open, its cards.
- ProjectView's kanban board drops its synthetic Inbox column -- just the
  real statuses now.
- DashboardView simplified to a plain grid of project tiles (name + card
  count); its per-project "New" section is gone, since a project card can no
  longer have no status.
- stores/cards.ts: patch/remove move to the global /api/cards/{id} routes.

Verified end-to-end against the rebuilt container (existing per-project-inbox
cards correctly migrated to the global inbox, 0 invariant violations) and the
dev server via headless Chrome: sidebar inbox -> project A "To do" -> back to
inbox -> project B "Done", full journey confirmed via the API at each step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/stores/cards.ts

@@ -6,8 +6,10 @@ import type { Card } from '../types'
 type CardPatch = Partial<Pick<Card, 'text' | 'complete'>>
 
 export const useCardsStore = defineStore('cards', () => {
-  // Every card in the project, grouped by column (inbox first) then position.
-  // Views re-sort as needed (the "all tasks" list is alphabetical).
+  // One project's cards, grouped by status then position. Views re-sort as
+  // needed (the "all tasks" list is alphabetical). Moving a card in or out of
+  // this project (including via the inbox) goes through lib/cardOrder.ts,
+  // not this store -- callers re-load() afterwards.
   const cards = ref<Card[]>([])
   const projectId = ref<number | null>(null)
   const loading = ref(false)
@@ -41,10 +43,11 @@ export const useCardsStore = defineStore('cards', () => {
   }
 
   async function patch(card: Card, fields: CardPatch): Promise<void> {
-    const { card: updated } = await apiRequest<{ card: Card }>(
-      `/projects/${projectId.value}/cards/${card.id}`,
-      { method: 'PATCH', auth: true, body: fields },
-    )
+    const { card: updated } = await apiRequest<{ card: Card }>(`/cards/${card.id}`, {
+      method: 'PATCH',
+      auth: true,
+      body: fields,
+    })
     const i = cards.value.findIndex((x) => x.id === updated.id)
     if (i !== -1) cards.value[i] = updated
   }
@@ -53,23 +56,10 @@ export const useCardsStore = defineStore('cards', () => {
   const setText = (card: Card, text: string) => patch(card, { text })
 
   async function remove(card: Card): Promise<void> {
-    await apiRequest(`/projects/${projectId.value}/cards/${card.id}`, { method: 'DELETE', auth: true })
+    await apiRequest(`/cards/${card.id}`, { method: 'DELETE', auth: true })
     cards.value = cards.value.filter((c) => c.id !== card.id)
   }
 
-  /**
-   * Set the contents and order of one status column (`null` = inbox). Cards
-   * dragged in from another column are re-parented server-side; the response is
-   * the whole project's cards, which replaces local state.
-   */
-  async function reorderColumn(statusId: number | null, cardIds: number[]): Promise<void> {
-    const { cards: fresh } = await apiRequest<{ cards: Card[] }>(
-      `/projects/${projectId.value}/cards/order`,
-      { method: 'PUT', auth: true, body: { status_id: statusId, card_ids: cardIds } },
-    )
-    cards.value = fresh
-  }
-
   function reset(): void {
     cards.value = []
     projectId.value = null
@@ -87,7 +77,6 @@ export const useCardsStore = defineStore('cards', () => {
     setComplete,
     setText,
     remove,
-    reorderColumn,
     reset,
   }
 })