feat: implement 8 OpenSpec proposals for security, reliability, and UX improvements

## Security Enhancements (P0)
- Add input validation with max_length and numeric range constraints
- Implement WebSocket token authentication via first message
- Add path traversal prevention in file storage service

## Permission Enhancements (P0)
- Add project member management for cross-department access
- Implement is_department_manager flag for workload visibility

## Cycle Detection (P0)
- Add DFS-based cycle detection for task dependencies
- Add formula field circular reference detection
- Display user-friendly cycle path visualization

## Concurrency & Reliability (P1)
- Implement optimistic locking with version field (409 Conflict on mismatch)
- Add trigger retry mechanism with exponential backoff (1s, 2s, 4s)
- Implement cascade restore for soft-deleted tasks

## Rate Limiting (P1)
- Add tiered rate limits: standard (60/min), sensitive (20/min), heavy (5/min)
- Apply rate limits to tasks, reports, attachments, and comments

## Frontend Improvements (P1)
- Add responsive sidebar with hamburger menu for mobile
- Improve touch-friendly UI with proper tap target sizes
- Complete i18n translations for all components

## Backend Reliability (P2)
- Configure database connection pool (size=10, overflow=20)
- Add Redis fallback mechanism with message queue
- Add blocker check before task deletion

## API Enhancements (P3)
- Add standardized response wrapper utility
- Add /health/ready and /health/live endpoints
- Implement project templates with status/field copying

## Tests Added
- test_input_validation.py - Schema and path traversal tests
- test_concurrency_reliability.py - Optimistic locking and retry tests
- test_backend_reliability.py - Connection pool and Redis tests
- test_api_enhancements.py - Health check and template tests

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -23,6 +23,8 @@ from app.models.project_health import ProjectHealth, RiskLevel, ScheduleStatus,
 from app.models.custom_field import CustomField, FieldType
 from app.models.task_custom_value import TaskCustomValue
 from app.models.task_dependency import TaskDependency, DependencyType
+from app.models.project_member import ProjectMember
+from app.models.project_template import ProjectTemplate
 
 __all__ = [
     "User", "Role", "Department", "Space", "Project", "TaskStatus", "Task", "WorkloadSnapshot",
@@ -33,5 +35,7 @@ __all__ = [
     "ScheduledReport", "ReportType", "ReportHistory", "ReportHistoryStatus",
     "ProjectHealth", "RiskLevel", "ScheduleStatus", "ResourceStatus",
     "CustomField", "FieldType", "TaskCustomValue",
-    "TaskDependency", "DependencyType"
+    "TaskDependency", "DependencyType",
+    "ProjectMember",
+    "ProjectTemplate"
 ]

backend/app/models/project.py

@@ -42,3 +42,6 @@ class Project(Base):
     triggers = relationship("Trigger", back_populates="project", cascade="all, delete-orphan")
     health = relationship("ProjectHealth", back_populates="project", uselist=False, cascade="all, delete-orphan")
     custom_fields = relationship("CustomField", back_populates="project", cascade="all, delete-orphan")
+
+    # Project membership for cross-department collaboration
+    members = relationship("ProjectMember", back_populates="project", cascade="all, delete-orphan")

backend/app/models/project_member.py

@@ -0,0 +1,56 @@
+"""ProjectMember model for cross-department project collaboration.
+
+This model tracks explicit project membership, allowing users from different
+departments to be granted access to projects they wouldn't normally have
+access to based on department isolation rules.
+"""
+import uuid
+from sqlalchemy import Column, String, ForeignKey, DateTime, UniqueConstraint
+from sqlalchemy.sql import func
+from sqlalchemy.orm import relationship
+from app.core.database import Base
+
+
+class ProjectMember(Base):
+    """
+    Represents a user's membership in a project.
+
+    This enables cross-department collaboration by explicitly granting
+    project access to users regardless of their department.
+
+    Roles:
+    - member: Can view and edit tasks
+    - admin: Can manage project settings and add other members
+    """
+    __tablename__ = "pjctrl_project_members"
+
+    id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    project_id = Column(
+        String(36),
+        ForeignKey("pjctrl_projects.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True
+    )
+    user_id = Column(
+        String(36),
+        ForeignKey("pjctrl_users.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True
+    )
+    role = Column(String(50), nullable=False, default="member")
+    added_by = Column(
+        String(36),
+        ForeignKey("pjctrl_users.id"),
+        nullable=False
+    )
+    created_at = Column(DateTime, server_default=func.now(), nullable=False)
+
+    # Unique constraint to prevent duplicate memberships
+    __table_args__ = (
+        UniqueConstraint('project_id', 'user_id', name='uq_project_member'),
+    )
+
+    # Relationships
+    project = relationship("Project", back_populates="members")
+    user = relationship("User", foreign_keys=[user_id], back_populates="project_memberships")
+    added_by_user = relationship("User", foreign_keys=[added_by])

backend/app/models/project_template.py

@@ -0,0 +1,125 @@
+"""Project Template model for reusable project configurations.
+
+Allows users to create templates with predefined task statuses and custom fields
+that can be used to quickly set up new projects.
+"""
+import uuid
+from sqlalchemy import Column, String, Text, Boolean, DateTime, ForeignKey, JSON
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+from app.core.database import Base
+
+
+class ProjectTemplate(Base):
+    """Template for creating projects with predefined configurations.
+
+    A template stores:
+    - Basic project metadata (name, description)
+    - Predefined task statuses (stored as JSON)
+    - Predefined custom field definitions (stored as JSON)
+
+    When a project is created from a template, the TaskStatus and CustomField
+    records are copied to the new project.
+    """
+    __tablename__ = "pjctrl_project_templates"
+
+    id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    name = Column(String(200), nullable=False)
+    description = Column(Text, nullable=True)
+
+    # Template owner
+    owner_id = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=False)
+
+    # Whether the template is available to all users or just the owner
+    is_public = Column(Boolean, default=False, nullable=False)
+
+    # Soft delete flag
+    is_active = Column(Boolean, default=True, nullable=False)
+
+    # Predefined task statuses as JSON array
+    # Format: [{"name": "To Do", "color": "#808080", "position": 0, "is_done": false}, ...]
+    task_statuses = Column(JSON, nullable=True)
+
+    # Predefined custom field definitions as JSON array
+    # Format: [{"name": "Priority", "field_type": "dropdown", "options": [...], ...}, ...]
+    custom_fields = Column(JSON, nullable=True)
+
+    # Optional default project settings
+    default_security_level = Column(String(20), default="department", nullable=True)
+
+    created_at = Column(DateTime, server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    # Relationships
+    owner = relationship("User", foreign_keys=[owner_id])
+
+
+# Default template data for system templates
+SYSTEM_TEMPLATES = [
+    {
+        "name": "Basic Project",
+        "description": "A simple project template with standard task statuses.",
+        "is_public": True,
+        "task_statuses": [
+            {"name": "To Do", "color": "#808080", "position": 0, "is_done": False},
+            {"name": "In Progress", "color": "#0066cc", "position": 1, "is_done": False},
+            {"name": "Done", "color": "#00cc66", "position": 2, "is_done": True},
+        ],
+        "custom_fields": [],
+    },
+    {
+        "name": "Software Development",
+        "description": "Template for software development projects with extended workflow.",
+        "is_public": True,
+        "task_statuses": [
+            {"name": "Backlog", "color": "#808080", "position": 0, "is_done": False},
+            {"name": "To Do", "color": "#3366cc", "position": 1, "is_done": False},
+            {"name": "In Progress", "color": "#0066cc", "position": 2, "is_done": False},
+            {"name": "Code Review", "color": "#cc6600", "position": 3, "is_done": False},
+            {"name": "Testing", "color": "#9933cc", "position": 4, "is_done": False},
+            {"name": "Done", "color": "#00cc66", "position": 5, "is_done": True},
+        ],
+        "custom_fields": [
+            {
+                "name": "Story Points",
+                "field_type": "number",
+                "is_required": False,
+                "position": 0,
+            },
+            {
+                "name": "Sprint",
+                "field_type": "dropdown",
+                "options": ["Sprint 1", "Sprint 2", "Sprint 3", "Backlog"],
+                "is_required": False,
+                "position": 1,
+            },
+        ],
+    },
+    {
+        "name": "Marketing Campaign",
+        "description": "Template for marketing campaign management.",
+        "is_public": True,
+        "task_statuses": [
+            {"name": "Planning", "color": "#808080", "position": 0, "is_done": False},
+            {"name": "Content Creation", "color": "#cc6600", "position": 1, "is_done": False},
+            {"name": "Review", "color": "#9933cc", "position": 2, "is_done": False},
+            {"name": "Scheduled", "color": "#0066cc", "position": 3, "is_done": False},
+            {"name": "Published", "color": "#00cc66", "position": 4, "is_done": True},
+        ],
+        "custom_fields": [
+            {
+                "name": "Channel",
+                "field_type": "dropdown",
+                "options": ["Email", "Social Media", "Website", "Print", "Event"],
+                "is_required": False,
+                "position": 0,
+            },
+            {
+                "name": "Target Audience",
+                "field_type": "text",
+                "is_required": False,
+                "position": 1,
+            },
+        ],
+    },
+]

backend/app/models/task.py

@@ -37,6 +37,9 @@ class Task(Base):
     created_at = Column(DateTime, server_default=func.now(), nullable=False)
     updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False)
 
+    # Optimistic locking field
+    version = Column(Integer, default=1, nullable=False)
+
     # Soft delete fields
     is_deleted = Column(Boolean, default=False, nullable=False, index=True)
     deleted_at = Column(DateTime, nullable=True)

backend/app/models/user.py

@@ -18,6 +18,7 @@ class User(Base):
     capacity = Column(Numeric(5, 2), default=40.00)
     is_active = Column(Boolean, default=True)
     is_system_admin = Column(Boolean, default=False)
+    is_department_manager = Column(Boolean, default=False)
     created_at = Column(DateTime, server_default=func.now())
     updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
 
@@ -41,3 +42,11 @@ class User(Base):
     # Automation relationships
     created_triggers = relationship("Trigger", back_populates="creator")
     scheduled_reports = relationship("ScheduledReport", back_populates="recipient", cascade="all, delete-orphan")
+
+    # Project membership relationships (for cross-department collaboration)
+    project_memberships = relationship(
+        "ProjectMember",
+        foreign_keys="ProjectMember.user_id",
+        back_populates="user",
+        cascade="all, delete-orphan"
+    )