Rename lists -> projects and items -> cards throughout

Project scope shifts from a todo list to a project-management app. This is a
straight terminology rename across code, comments, migrations, tests, and
docs — no behaviour change.

- DB: table todo_lists -> projects, todo_items -> cards, column
  todo_items.list_id -> cards.project_id, indexes renamed. Migrations 003/004
  rewritten in place (destructive; recreate the volume with `down -v`).
- API: /api/lists -> /api/projects, nested /items -> /cards, reorder body
  item_ids -> card_ids, JSON keys list/lists/item/items -> project/projects/
  card/cards, item_count -> card_count, list_id -> project_id, and the
  matching error messages.
- PHP: TodoList/TodoItem Repository + Controller -> Project/Card; shared SQL
  aliases l/i -> p/c.
- Frontend: stores lists.ts/items.ts -> projects.ts/cards.ts (useProjectsStore
  / useCardsStore, MAX_PROJECTS), ListView -> ProjectView, TodoItemRow ->
  CardRow, route /lists/:id -> /projects/:id (name "project"), types TodoList/
  TodoItem -> Project/Card, and all UI copy. CSS .lists*/.list-head* ->
  .projects*/.project-head*, .item* -> .card-row* (kept the generic .card
  panel class), .items -> .cards.
- Product name in the header, PWA manifest, index.html title and package
  descriptions -> "Project Manager" / "Projects".

Backend suite: 37 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/README.md

@@ -1,4 +1,4 @@
-# Todo List — web
+# Project Manager — web
 
 Vue 3 + TypeScript + Vite PWA. Talks to the REST API in the parent directory.
 
@@ -38,25 +38,25 @@ npm run preview
 src/main.ts             App bootstrap; resolves the stored session before mount
 src/router/index.ts     Routes + guard (redirects to /login when unauthenticated)
 src/stores/auth.ts      Pinia store: token in localStorage, register/login/fetchMe
-src/stores/lists.ts     Pinia store: the user's lists (fetch + create)
-src/stores/items.ts     Pinia store: one list's items (CRUD + drag reorder)
+src/stores/projects.ts  Pinia store: the user's projects (fetch + create)
+src/stores/cards.ts     Pinia store: one project's cards (CRUD + drag reorder)
 src/lib/api.ts          fetch wrapper, bearer token, typed ApiError
-src/components/TodoItemRow.vue  checkbox + editable text + delete, one item
-src/views/              HomeView, ListView, LoginView, RegisterView,
+src/components/CardRow.vue  checkbox + editable text + delete, one card
+src/views/              HomeView, ProjectView, LoginView, RegisterView,
                         ProfileView, VerifyEmailView
 ```
 
-## List detail
+## Project detail
 
-`/lists/:id` shows one list. The title and description are inline-editable
-(saved on blur via `PATCH /api/lists/:id`; the description shows an "Add a
+`/projects/:id` shows one project. The title and description are inline-editable
+(saved on blur via `PATCH /api/projects/:id`; the description shows an "Add a
 description" placeholder when empty). A **Manage** menu (top right) has a
-**Delete list** action that opens a confirmation modal; confirming calls
-`DELETE /api/lists/:id` and returns to the all-lists view.
+**Delete project** action that opens a confirmation modal; confirming calls
+`DELETE /api/projects/:id` and returns to the all-projects view.
 
-Each item row is a checkbox, an inline-editable text field (saved on blur), a
+Each card row is a checkbox, an inline-editable text field (saved on blur), a
 delete button, and a drag handle. Reordering uses `vuedraggable`; on drop the
-whole new order is persisted via `PUT /api/lists/:id/items/order`, and the
+whole new order is persisted via `PUT /api/projects/:id/cards/order`, and the
 server response replaces local state.
 
 ## Auth flow
@@ -81,7 +81,7 @@ server response replaces local state.
 - `/verify-email?token=…` is the target for every magic link (verification,
   passwordless login, email change). `VerifyEmailView` POSTs the token to the
   API, which returns a session — so opening any link both verifies the address
-  and signs the user in — then redirects to the lists.
+  and signs the user in — then redirects to the projects.
 - `/profile` (`ProfileView`) shows the address and verification status. When
   unverified it offers a **Resend** button; the API throttles to once a minute,
   and the button shows a live countdown (driven by `retry_after`, and by `429`