Add per-project card statuses and a kanban board

Statuses
- Migration 006: card_statuses table (project-scoped) and cards.status_id, a
  nullable FK with ON DELETE SET NULL. Every new project is seeded with
  "To do" / "Doing" / "Done"; GET /api/projects/{id}/statuses lists them.
- New cards have no status -- they sit in an "inbox" until moved.

Project view
- Full-width and tabbed: "All tasks" (a flat list, sorted by name
  case-insensitively) and "Kanban" (Inbox plus one column per status).
- Drag a card within or between columns to reorder / restatus; the Inbox
  column has its own name + Add form.

Ordering
- Migration 007: `position` is now a dense 0..n-1 rank within a
  (project_id, status_id) column, not a project-wide order. New composite
  index idx_cards_project_status_position; existing rows re-ranked.
- PUT /api/projects/{id}/cards/order takes { status_id, card_ids } and sets one
  column's contents and order, re-parenting moved-in cards and re-packing their
  source column in a single transaction. PATCH status_id appends the card to the
  end of the destination column.

58 phpunit tests pass; the frontend type-checks and builds.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/bootstrap.php

@@ -7,6 +7,7 @@ use App\Auth\JwtService;
 use App\Auth\SessionPayload;
 use App\Http\Controllers\AuthController;
 use App\Http\Controllers\CardController;
+use App\Http\Controllers\CardStatusController;
 use App\Http\Controllers\EmailVerificationController;
 use App\Http\Controllers\ProjectController;
 use App\Http\JsonErrorHandler;
@@ -15,6 +16,7 @@ use App\Mail\LogMailer;
 use App\Mail\Mailer;
 use App\Mail\PhpMailerMailer;
 use App\Repository\CardRepository;
+use App\Repository\CardStatusRepository;
 use App\Repository\EmailVerificationRepository;
 use App\Repository\ProjectRepository;
 use App\Repository\UserRepository;
@@ -43,6 +45,7 @@ $errorMiddleware->setDefaultErrorHandler(
 $users = new UserRepository($database->pdo());
 $projects = new ProjectRepository($database->pdo());
 $cards = new CardRepository($database->pdo());
+$cardStatuses = new CardStatusRepository($database->pdo());
 $verificationTokens = new EmailVerificationRepository($database->pdo());
 $jwt = new JwtService($config->jwtSecret, $config->jwtTtl);
 $session = new SessionPayload($jwt, $verificationTokens);
@@ -55,8 +58,9 @@ $verifier = new EmailVerifier($verificationTokens, $users, $mailer, $config->app
 
 $authController = new AuthController($users, $session, $verifier);
 $emailController = new EmailVerificationController($users, $verificationTokens, $verifier, $session);
-$projectController = new ProjectController($projects);
-$cardController = new CardController($projects, $cards);
+$projectController = new ProjectController($projects, $cardStatuses);
+$cardController = new CardController($projects, $cards, $cardStatuses);
+$cardStatusController = new CardStatusController($projects, $cardStatuses);
 $authMiddleware = new AuthMiddleware($jwt, $users);
 
 // --- Routes ---------------------------------------------------------------
@@ -66,6 +70,7 @@ $app->group('/api', function (RouteCollectorProxy $group) use (
     $emailController,
     $projectController,
     $cardController,
+    $cardStatusController,
     $authMiddleware,
 ) {
     $group->get('/health', function (Request $request, Response $response): Response {
@@ -82,13 +87,19 @@ $app->group('/api', function (RouteCollectorProxy $group) use (
     $group->post('/email/verification', [$emailController, 'resend'])->add($authMiddleware);
     $group->post('/email/change', [$emailController, 'requestChange'])->add($authMiddleware);
 
-    $group->group('/projects', function (RouteCollectorProxy $projects) use ($projectController, $cardController) {
+    $group->group('/projects', function (RouteCollectorProxy $projects) use (
+        $projectController,
+        $cardController,
+        $cardStatusController,
+    ) {
         $projects->get('', [$projectController, 'index']);
         $projects->post('', [$projectController, 'store']);
         $projects->get('/{projectId:[0-9]+}', [$projectController, 'show']);
         $projects->patch('/{projectId:[0-9]+}', [$projectController, 'update']);
         $projects->delete('/{projectId:[0-9]+}', [$projectController, 'destroy']);
 
+        $projects->get('/{projectId:[0-9]+}/statuses', [$cardStatusController, 'index']);
+
         $projects->get('/{projectId:[0-9]+}/cards', [$cardController, 'index']);
         $projects->post('/{projectId:[0-9]+}/cards', [$cardController, 'store']);
         $projects->put('/{projectId:[0-9]+}/cards/order', [$cardController, 'reorder']);