promote staging/sprint-1 Week-2 harden to main

[habiibullahm]

Summary

promotion of staging/sprint-1 → main after Week-2 (harden personal product) work was merged and verified on staging.

• Real password-reset mail via SMTP (preferred) or optional Resend; generic forgot-password responses; hashed single-use reset tokens
• Task list UX polish: Cancelled + priority chips, dual empty states, URL-synced filters/search/sort, dashboard deep-links
• Ops: free-port for local API, DEPLOY/README/render.yaml env docs (APP_URL, CORS_ORIGIN, SMTP/Resend)
• Tests: integration (change/forgot/reset, mailer, priority/sort) + e2e (forgot flow, empty/priority, dashboard links)

Test plan

• CI green on this PR
• After future merge + Render redeploy: /api/v1/health → data.db: ok
• Register → tasks filters/empty states → change password → forgot/reset email
• Confirm Render env: CORS_ORIGIN, APP_URL, SMTP_* or RESEND_API_KEY, UI VITE_API_BASE_URL

Notes

• Draft only — do not merge until ready for production Render (main).
• Staging already includes PRs feat: real password-reset emails + week-2 harden (staging) #12–feat: polish task list UX and finish Week-2 Day 5 docs #14 lineage (emails, SMTP, task-list polish).