feat: complete issue fixes and implement remaining features

## Critical Issues (CRIT-001~003) - All Fixed
- JWT secret key validation with pydantic field_validator
- Login audit logging for success/failure attempts
- Frontend API path prefix removal

## High Priority Issues (HIGH-001~008) - All Fixed
- Project soft delete using is_active flag
- Redis session token bytes handling
- Rate limiting with slowapi (5 req/min for login)
- Attachment API permission checks
- Kanban view with drag-and-drop
- Workload heatmap UI (WorkloadPage, WorkloadHeatmap)
- TaskDetailModal integrating Comments/Attachments
- UserSelect component for task assignment

## Medium Priority Issues (MED-001~012) - All Fixed
- MED-001~005: DB commits, N+1 queries, datetime, error format, blocker flag
- MED-006: Project health dashboard (HealthService, ProjectHealthPage)
- MED-007: Capacity update API (PUT /api/users/{id}/capacity)
- MED-008: Schedule triggers (cron parsing, deadline reminders)
- MED-009: Watermark feature (image/PDF watermarking)
- MED-010~012: useEffect deps, DOM operations, PDF export

## New Files
- backend/app/api/health/ - Project health API
- backend/app/services/health_service.py
- backend/app/services/trigger_scheduler.py
- backend/app/services/watermark_service.py
- backend/app/core/rate_limiter.py
- frontend/src/pages/ProjectHealthPage.tsx
- frontend/src/components/ProjectHealthCard.tsx
- frontend/src/components/KanbanBoard.tsx
- frontend/src/components/WorkloadHeatmap.tsx

## Tests
- 113 new tests passing (health: 32, users: 14, triggers: 35, watermark: 32)

## OpenSpec Archives
- add-project-health-dashboard
- add-capacity-update-api
- add-schedule-triggers
- add-watermark-feature
- add-rate-limiting
- enhance-frontend-ux
- add-resource-management-ui

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/schemas/project_health.py

@@ -0,0 +1,68 @@
+from pydantic import BaseModel
+from typing import Optional, List
+from datetime import datetime
+from enum import Enum
+
+
+class RiskLevel(str, Enum):
+    LOW = "low"
+    MEDIUM = "medium"
+    HIGH = "high"
+    CRITICAL = "critical"
+
+
+class ScheduleStatus(str, Enum):
+    ON_TRACK = "on_track"
+    AT_RISK = "at_risk"
+    DELAYED = "delayed"
+
+
+class ResourceStatus(str, Enum):
+    ADEQUATE = "adequate"
+    CONSTRAINED = "constrained"
+    OVERLOADED = "overloaded"
+
+
+class ProjectHealthBase(BaseModel):
+    health_score: int
+    risk_level: RiskLevel
+    schedule_status: ScheduleStatus
+    resource_status: ResourceStatus
+
+
+class ProjectHealthResponse(ProjectHealthBase):
+    id: str
+    project_id: str
+    last_updated: datetime
+
+    class Config:
+        from_attributes = True
+
+
+class ProjectHealthWithDetails(ProjectHealthResponse):
+    """Extended health response with project and computed metrics."""
+    project_title: str
+    project_status: str
+    owner_name: Optional[str] = None
+    space_name: Optional[str] = None
+    task_count: int = 0
+    completed_task_count: int = 0
+    blocker_count: int = 0
+    overdue_task_count: int = 0
+
+
+class ProjectHealthSummary(BaseModel):
+    """Aggregated health metrics across all projects."""
+    total_projects: int
+    healthy_count: int  # health_score >= 80
+    at_risk_count: int  # health_score 50-79
+    critical_count: int  # health_score < 50
+    average_health_score: float
+    projects_with_blockers: int
+    projects_delayed: int
+
+
+class ProjectHealthDashboardResponse(BaseModel):
+    """Full dashboard response with project list and summary."""
+    projects: List[ProjectHealthWithDetails]
+    summary: ProjectHealthSummary

backend/app/schemas/trigger.py

@@ -1,14 +1,32 @@
 from datetime import datetime
-from typing import Optional, List, Dict, Any
+from typing import Optional, List, Dict, Any, Union
 from pydantic import BaseModel, Field
 
 
-class TriggerCondition(BaseModel):
+class FieldChangeCondition(BaseModel):
+    """Condition for field_change triggers."""
     field: str = Field(..., description="Field to check: status_id, assignee_id, priority")
     operator: str = Field(..., description="Operator: equals, not_equals, changed_to, changed_from")
     value: str = Field(..., description="Value to compare against")
 
 
+class ScheduleCondition(BaseModel):
+    """Condition for schedule triggers."""
+    cron_expression: Optional[str] = Field(None, description="Cron expression (e.g., '0 9 * * 1' for Monday 9am)")
+    deadline_reminder_days: Optional[int] = Field(None, ge=1, le=365, description="Days before due date to send reminder")
+
+
+class TriggerCondition(BaseModel):
+    """Union condition that supports both field_change and schedule triggers."""
+    # Field change conditions
+    field: Optional[str] = Field(None, description="Field to check: status_id, assignee_id, priority")
+    operator: Optional[str] = Field(None, description="Operator: equals, not_equals, changed_to, changed_from")
+    value: Optional[str] = Field(None, description="Value to compare against")
+    # Schedule conditions
+    cron_expression: Optional[str] = Field(None, description="Cron expression for schedule triggers")
+    deadline_reminder_days: Optional[int] = Field(None, ge=1, le=365, description="Days before due date to send reminder")
+
+
 class TriggerAction(BaseModel):
     type: str = Field(default="notify", description="Action type: notify")
     target: str = Field(default="assignee", description="Target: assignee, creator, project_owner, user:<id>")

backend/app/schemas/user.py

@@ -1,4 +1,4 @@
-from pydantic import BaseModel
+from pydantic import BaseModel, field_validator
 from typing import Optional, List
 from datetime import datetime
 from decimal import Decimal
@@ -39,3 +39,25 @@ class UserResponse(UserBase):
 
 class UserInDB(UserResponse):
     pass
+
+
+class CapacityUpdate(BaseModel):
+    """Schema for updating user's weekly capacity hours."""
+    capacity_hours: Decimal
+
+    @field_validator("capacity_hours")
+    @classmethod
+    def validate_capacity_hours(cls, v: Decimal) -> Decimal:
+        """Validate capacity hours is within valid range (0-168)."""
+        if v < 0:
+            raise ValueError("Capacity hours must be non-negative")
+        if v > 168:
+            raise ValueError("Capacity hours cannot exceed 168 (hours in a week)")
+        return v
+
+    class Config:
+        json_schema_extra = {
+            "example": {
+                "capacity_hours": 40.00
+            }
+        }