feat: implement projects and tasks foundation MVP

[raphaeltm]

Summary

• Implements /speckit.implement for specs/016-mvp-project-and (projects + tasks MVP foundation).
• Adds project/task data model + migration, API routes/services, web pages/components, and tests.
• Adds config-driven project/task runtime limits and callback settings, updates docs/spec artifacts, and keeps AGENTS.md and CLAUDE.md synced.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test
• Additional validation run (if applicable)
• Mobile and desktop verification notes added for UI changes

Additional validation run:

• pnpm --filter @simple-agent-manager/api test
• pnpm --filter @simple-agent-manager/web test
• pnpm build

Mobile verification notes:

• Verified new Projects/Project mobile layouts using Playwright screenshot harness at 375x667.
• Artifacts: .codex/tmp/playwright-screenshots/projects-mobile.png, .codex/tmp/playwright-screenshots/project-mobile.png.

UI Compliance Checklist (Required for UI changes)

• Mobile-first layout verified
• Accessibility checks completed
• Shared UI components used or exception documented

Exceptions (If any)

• Scope: N/A
• Rationale: N/A
• Expiration: N/A

Agent Preflight (Required)

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

• GitHub Projects: https://docs.github.com/en/issues/planning-and-tracking-with-projects/learning-about-projects/about-projects
• GitHub Sub-issues: https://docs.github.com/en/issues/tracking-your-work-with-issues/about-sub-issues
• GitHub Issue dependencies: https://docs.github.com/en/issues/tracking-your-work-with-issues/using-issues/creating-issue-dependencies
• Linear dependencies: https://linear.app/docs/issue-relations-and-dependencies
• Jira issue links: https://support.atlassian.com/jira-software-cloud/docs/what-are-issue-links/

Codebase Impact Analysis

• packages/shared: new project/task types and defaults.
• apps/api: migration/schema, project/task routes, graph/status services, ownership middleware, env/runtime limits.
• apps/web: project pages, task components, API client additions, routing/navigation updates.
• apps/api/tests and apps/web/tests: new route/service/page/component coverage for project/task flows.

Documentation & Specs

• specs/016-mvp-project-and/spec.md
• specs/016-mvp-project-and/plan.md
• specs/016-mvp-project-and/research.md
• specs/016-mvp-project-and/data-model.md
• specs/016-mvp-project-and/contracts/api.yaml
• specs/016-mvp-project-and/quickstart.md
• specs/016-mvp-project-and/tasks.md
• apps/api/.env.example
• AGENTS.md
• CLAUDE.md

Constitution & Risk Check

• Checked constitution principles with focus on Principle XI:
  • New limits/timeouts are env-configurable (MAX_PROJECTS_PER_USER, MAX_TASKS_PER_PROJECT, MAX_TASK_DEPENDENCIES_PER_TASK, TASK_LIST_DEFAULT_PAGE_SIZE, TASK_LIST_MAX_PAGE_SIZE, TASK_CALLBACK_TIMEOUT_MS, TASK_CALLBACK_RETRY_MAX_ATTEMPTS).
  • No new hardcoded internal app/api/ws URLs were introduced.
  • Delegated-task callback updates enforce token and ownership alignment (workspace claim must match task workspace).
• Main risks/tradeoffs:
  • Cursor pagination currently uses ULID ordering; acceptable for MVP but can be revisited for strict multi-sort pagination.
  • UI relies on MVP list-driven task management and manual delegation (automation deferred by design).