feat: complete LOW priority code quality improvements

Backend:
- LOW-002: Add Query validation with max page size limits (100)
- LOW-003: Replace magic strings with TaskStatus.is_done flag
- LOW-004: Add 'creation' trigger type validation
- Add action_executor.py with UpdateFieldAction and AutoAssignAction

Frontend:
- LOW-005: Replace TypeScript 'any' with 'unknown' + type guards
- LOW-006: Add ConfirmModal component with A11Y support
- LOW-007: Add ToastContext for user feedback notifications
- LOW-009: Add Skeleton components (17 loading states replaced)
- LOW-010: Setup Vitest with 21 tests for ConfirmModal and Skeleton

Components updated:
- App.tsx, ProtectedRoute.tsx, Spaces.tsx, Projects.tsx, Tasks.tsx
- ProjectSettings.tsx, AuditPage.tsx, WorkloadPage.tsx, ProjectHealthPage.tsx
- Comments.tsx, AttachmentList.tsx, TriggerList.tsx, TaskDetailModal.tsx
- NotificationBell.tsx, BlockerDialog.tsx, CalendarView.tsx, WorkloadUserDetail.tsx

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/tests/test_encryption.py

@@ -273,3 +273,145 @@ class TestEncryptionKeyValidation:
         }):
             settings = Settings()
             assert settings.ENCRYPTION_MASTER_KEY is None
+
+
+class TestConfidentialProjectUpload:
+    """Tests for file upload on confidential projects."""
+
+    @pytest.fixture
+    def test_user(self, db):
+        """Create a test user."""
+        from app.models import User
+        import uuid as uuid_module
+
+        user = User(
+            id=str(uuid_module.uuid4()),
+            email="testuser_enc@example.com",
+            name="Test User Encryption",
+            role_id="00000000-0000-0000-0000-000000000003",
+            is_active=True,
+            is_system_admin=False,
+        )
+        db.add(user)
+        db.commit()
+        return user
+
+    @pytest.fixture
+    def test_user_token(self, client, mock_redis, test_user):
+        """Get a token for test user."""
+        from app.core.security import create_access_token, create_token_payload
+
+        token_data = create_token_payload(
+            user_id=test_user.id,
+            email=test_user.email,
+            role="engineer",
+            department_id=None,
+            is_system_admin=False,
+        )
+        token = create_access_token(token_data)
+        mock_redis.setex(f"session:{test_user.id}", 900, token)
+        return token
+
+    @pytest.fixture
+    def test_space(self, db, test_user):
+        """Create a test space."""
+        from app.models import Space
+        import uuid as uuid_module
+
+        space = Space(
+            id=str(uuid_module.uuid4()),
+            name="Test Space Encryption",
+            description="Test space for encryption tests",
+            owner_id=test_user.id,
+        )
+        db.add(space)
+        db.commit()
+        return space
+
+    @pytest.fixture
+    def confidential_project(self, db, test_space, test_user):
+        """Create a confidential test project."""
+        from app.models import Project
+        import uuid as uuid_module
+
+        project = Project(
+            id=str(uuid_module.uuid4()),
+            space_id=test_space.id,
+            title="Confidential Project",
+            description="Test confidential project",
+            owner_id=test_user.id,
+            security_level="confidential",
+        )
+        db.add(project)
+        db.commit()
+        return project
+
+    @pytest.fixture
+    def test_task(self, db, confidential_project, test_user):
+        """Create a test task in confidential project."""
+        from app.models import Task
+        import uuid as uuid_module
+
+        task = Task(
+            id=str(uuid_module.uuid4()),
+            project_id=confidential_project.id,
+            title="Test Task Encryption",
+            description="Test task for encryption tests",
+            created_by=test_user.id,
+        )
+        db.add(task)
+        db.commit()
+        return task
+
+    def test_upload_confidential_project_encryption_unavailable(
+        self, client, test_user_token, test_task, db
+    ):
+        """Test that uploading to confidential project returns 400 when encryption is unavailable."""
+        from io import BytesIO
+
+        # Mock encryption service to return False for is_encryption_available
+        with patch('app.api.attachments.router.encryption_service') as mock_enc_service:
+            mock_enc_service.is_encryption_available.return_value = False
+
+            content = b"Test file content"
+            files = {"file": ("test.pdf", BytesIO(content), "application/pdf")}
+
+            response = client.post(
+                f"/api/tasks/{test_task.id}/attachments",
+                headers={"Authorization": f"Bearer {test_user_token}"},
+                files=files,
+            )
+
+            assert response.status_code == 400
+            assert "ENCRYPTION_MASTER_KEY" in response.json()["detail"]
+            assert "environment variable" in response.json()["detail"]
+
+    def test_upload_confidential_project_no_active_key(
+        self, client, test_user_token, test_task, db
+    ):
+        """Test that uploading to confidential project returns 400 when no active encryption key exists."""
+        from io import BytesIO
+        from app.models import EncryptionKey
+
+        # Make sure no active encryption keys exist
+        db.query(EncryptionKey).filter(EncryptionKey.is_active == True).update(
+            {"is_active": False}
+        )
+        db.commit()
+
+        # Mock encryption service to return True for is_encryption_available
+        with patch('app.api.attachments.router.encryption_service') as mock_enc_service:
+            mock_enc_service.is_encryption_available.return_value = True
+
+            content = b"Test file content"
+            files = {"file": ("test.pdf", BytesIO(content), "application/pdf")}
+
+            response = client.post(
+                f"/api/tasks/{test_task.id}/attachments",
+                headers={"Authorization": f"Bearer {test_user_token}"},
+                files=files,
+            )
+
+            assert response.status_code == 400
+            assert "active encryption key" in response.json()["detail"]
+            assert "create" in response.json()["detail"].lower()