Add per-project card statuses and a kanban board

Statuses
- Migration 006: card_statuses table (project-scoped) and cards.status_id, a
  nullable FK with ON DELETE SET NULL. Every new project is seeded with
  "To do" / "Doing" / "Done"; GET /api/projects/{id}/statuses lists them.
- New cards have no status -- they sit in an "inbox" until moved.

Project view
- Full-width and tabbed: "All tasks" (a flat list, sorted by name
  case-insensitively) and "Kanban" (Inbox plus one column per status).
- Drag a card within or between columns to reorder / restatus; the Inbox
  column has its own name + Add form.

Ordering
- Migration 007: `position` is now a dense 0..n-1 rank within a
  (project_id, status_id) column, not a project-wide order. New composite
  index idx_cards_project_status_position; existing rows re-ranked.
- PUT /api/projects/{id}/cards/order takes { status_id, card_ids } and sets one
  column's contents and order, re-parenting moved-in cards and re-packing their
  source column in a single transaction. PATCH status_id appends the card to the
  end of the destination column.

58 phpunit tests pass; the frontend type-checks and builds.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/README.md

@@ -2,7 +2,7 @@
 
 Vue 3 + TypeScript + Vite PWA. Talks to the REST API in the parent directory.
 
-## Develop on the host
+## Develop
 
 ```bash
 npm install
@@ -14,17 +14,6 @@ run `docker compose up -d` in the parent directory first). Override the target
 with `VITE_PROXY_TARGET`, or point the app at a different API entirely with
 `VITE_API_BASE_URL` (see [.env.example](.env.example)).
 
-## Develop in Docker
-
-From the parent directory:
-
-```bash
-docker compose --profile frontend up -d
-```
-
-Runs this dev server alongside the API. `/api` is proxied to the `app` container.
-After changing `package.json`, rebuild: `docker compose build web`.
-
 ## Build
 
 ```bash
@@ -32,6 +21,11 @@ npm run build         # type-checks, then emits dist/
 npm run preview
 ```
 
+The parent `Dockerfile` runs this build in a Node stage and copies `dist/` into
+the PHP image's `public/`, so the `app` container serves the compiled SPA at `/`.
+There is no separate frontend container — a production image is `docker compose
+build app` from the parent directory.
+
 ## Layout
 
 ```
@@ -39,25 +33,47 @@ src/main.ts             App bootstrap; resolves the stored session before mount
 src/router/index.ts     Routes + guard (redirects to /login when unauthenticated)
 src/stores/auth.ts      Pinia store: token in localStorage, register/login/fetchMe
 src/stores/projects.ts  Pinia store: the user's projects (fetch + create)
-src/stores/cards.ts     Pinia store: one project's cards (CRUD + drag reorder)
+src/stores/cards.ts     Pinia store: one project's cards (CRUD + reorderColumn)
 src/lib/api.ts          fetch wrapper, bearer token, typed ApiError
-src/components/CardRow.vue  checkbox + editable text + delete, one card
+src/components/CardRow.vue    editable text + status chip + delete, one card
+src/components/KanbanCard.vue small draggable card for the board columns
 src/views/              HomeView, ProjectView, LoginView, RegisterView,
                         ProfileView, VerifyEmailView
 ```
 
 ## Project detail
 
-`/projects/:id` shows one project. The title and description are inline-editable
-(saved on blur via `PATCH /api/projects/:id`; the description shows an "Add a
-description" placeholder when empty). A **Manage** menu (top right) has a
-**Delete project** action that opens a confirmation modal; confirming calls
-`DELETE /api/projects/:id` and returns to the all-projects view.
+`/projects/:id` shows one project. It renders on a **full-width** layout (the
+route sets `meta.wide`, which widens `.app__main` in `App.vue`). The title and
+description are inline-editable (saved on blur via `PATCH /api/projects/:id`; the
+description shows an "Add a description" placeholder when empty). A **Manage**
+menu (top right) has a **Delete project** action that opens a confirmation modal;
+confirming calls `DELETE /api/projects/:id` and returns to the all-projects view.
 
-Each card row is a checkbox, an inline-editable text field (saved on blur), a
-delete button, and a drag handle. Reordering uses `vuedraggable`; on drop the
-whole new order is persisted via `PUT /api/projects/:id/cards/order`, and the
-server response replaces local state.
+Below the header are two tabs (local `activeTab` state, `v-show` so both stay
+mounted):
+
+### All tasks
+
+The flat card list, **sorted by name (case-insensitive)** via a `sortedCards`
+computed — there is no manual order here. Each row is an inline-editable text
+field (saved on blur), a status chip (`card.status.name` or "No status"), and a
+delete button.
+
+### Kanban
+
+Columns, left to right: **Inbox** (cards with no status) then each project
+status in `position` order. `board` is derived from `cards.cards` + the
+project's statuses and rebuilt by a `watch` whenever either changes.
+
+Every drop — whether reordering within a column (`moved`) or dragging in from
+another (`added`) — calls `cards.reorderColumn(column.statusId, ids)` →
+`PUT /api/projects/:id/cards/order` with `{ status_id, card_ids }`. The server
+re-parents any moved-in card, re-packs the source column, and returns the whole
+project's cards, which replaces local state; on failure the board reloads.
+
+The Inbox column has a small name + **Add** form at the bottom (`cards.add`);
+new cards have no status, so they land straight in it.
 
 ## Auth flow