Reorganize docs: simple README + organized docs/

Removed docs/stage-1-auth-api.md -- an early planning doc, badly out
of date (predates passwordless auth, statuses, the inbox, and
everything after).

README.md is now just: what this is, a pointer to docs/, an end-user
getting-started guide (Docker up, first-time login via the bundled
Mailpit catcher, adding a passkey), and provenance -- everything else
it used to carry moved out:

- docs/api.md -- the full REST API reference (auth, passkeys,
  projects, cards, statuses, error shape) + the curl walkthrough.
- docs/setup.md -- running without Docker, every environment
  variable, the test suite.
- docs/architecture.md -- backend file layout; points to
  web/README.md for the frontend, which already documented itself in
  enough depth to stand alone.
- docs/history.md -- the stage-by-stage feature log, with a new row
  for this session's refactoring work (which hadn't been logged yet).
- docs/README.md -- an index tying the above together.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/history.md

@@ -0,0 +1,29 @@
+# Development history
+
+A stage-by-stage log of major features, in the order they landed. Each row
+describes the app as it was *at that point* — later stages sometimes
+superseded earlier ones (e.g. password login, added in stage 1, was removed
+again in stage 12); see [docs/api.md](api.md) and
+[web/README.md](../web/README.md) for how things work now.
+
+| Stage | Scope | State |
+|-------|-------|-------|
+| 1 | Auth API — register, login, `GET /me` | ✅ done |
+| 2 | Frontend shell — Vite PWA, auth-gated routing, register/login pages | ✅ done |
+| 3 | Project + card CRUD API | ✅ done |
+| 4 | Frontend projects view — project index + create form | ✅ done |
+| 5 | Frontend project detail — cards UI with drag-and-drop reorder | ✅ done |
+| 6 | Project view — inline title/description editing, delete via a Manage menu | ✅ done |
+| 7 | Email verification (magic links) + profile page (resend, change email) | ✅ done |
+| 8 | Passwordless login — magic-link by default, password login behind a toggle | ✅ done |
+| 9 | Per-project card statuses ("To do" / "Doing" / "Done"); status chip, new cards start with none | ✅ done |
+| 10 | Project view — full-width, tabbed: alphabetical "All tasks" list + "Kanban" board, per-column drag ordering | ✅ done |
+| 11 | Persistent left sidebar (Dashboard link + project dropdown); dashboard = grid of project tiles + a "Create a project" tile | ✅ done |
+| 12 | Passwordless-only auth — registration and password login removed; a magic link is the sole way in, and creates the account if needed | ✅ done |
+| 13 | Global inbox — cards can have no project; moved into the sidebar, drag in/out of any project's kanban columns | ✅ done |
+| 14 | New-project form moved to the dashboard; sidebar project list is now a switcher dropdown; Kanban is a project's default tab | ✅ done |
+| 15 | Passkeys (WebAuthn) — register from the profile page, sign in with one instead of a magic link; a dismissible notice nudges users with none | ✅ done |
+| 16 | Project configuration view — manage a project's statuses: add, drag to reorder, delete (reassigning any cards on it first) | ✅ done |
+| 17 | Card detail view (`/cards/:id`) + its own configuration view — a card's text is no longer inline-editable; every list links to its own page instead | ✅ done |
+| 18 | Project view split into real routes — Explore (`/projects/:id`) and Kanban (`/projects/:id/kanban`) are separate pages under a shared layout, not client-side tab state | ✅ done |
+| 19 | Backend/frontend refactoring pass — deduplicated controller/repository boilerplate and CSS, dropped the never-surfaced project `description` field, squashed the SQL migration history into one clean initial schema | ✅ done |