feat: implement task management module

Backend (FastAPI):
- Database migration for spaces, projects, task_statuses, tasks tables
- SQLAlchemy models with relationships
- Pydantic schemas for CRUD operations
- Spaces API: CRUD with soft delete
- Projects API: CRUD with auto-created default statuses
- Tasks API: CRUD, status change, assign, subtask support
- Permission middleware with Security Level filtering
- Subtask depth limit (max 2 levels)

Frontend (React + Vite):
- Layout component with navigation
- Spaces list page
- Projects list page
- Tasks list page with status management

Fixes:
- auth_client.py: use 'username' field for external API
- config.py: extend JWT expiry to 7 days
- auth/router.py: sync Redis session with JWT expiry

Tests: 36 passed (unit + integration)
E2E: All APIs verified with real authentication

OpenSpec: add-task-management archived

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -1,5 +1,9 @@
 from app.models.user import User
 from app.models.role import Role
 from app.models.department import Department
+from app.models.space import Space
+from app.models.project import Project
+from app.models.task_status import TaskStatus
+from app.models.task import Task
 
-__all__ = ["User", "Role", "Department"]
+__all__ = ["User", "Role", "Department", "Space", "Project", "TaskStatus", "Task"]

backend/app/models/department.py

@@ -15,3 +15,6 @@ class Department(Base):
 
     # Self-referential relationship
     parent = relationship("Department", remote_side=[id], backref="children")
+
+    # Project relationship
+    projects = relationship("Project", back_populates="department")

backend/app/models/project.py

@@ -0,0 +1,40 @@
+from sqlalchemy import Column, String, Text, Boolean, DateTime, Date, Numeric, Enum, ForeignKey
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+from app.core.database import Base
+import enum
+
+
+class SecurityLevel(str, enum.Enum):
+    PUBLIC = "public"
+    DEPARTMENT = "department"
+    CONFIDENTIAL = "confidential"
+
+
+class Project(Base):
+    __tablename__ = "pjctrl_projects"
+
+    id = Column(String(36), primary_key=True)
+    space_id = Column(String(36), ForeignKey("pjctrl_spaces.id", ondelete="CASCADE"), nullable=False)
+    title = Column(String(200), nullable=False)
+    description = Column(Text, nullable=True)
+    owner_id = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=False)
+    budget = Column(Numeric(15, 2), nullable=True)
+    start_date = Column(Date, nullable=True)
+    end_date = Column(Date, nullable=True)
+    security_level = Column(
+        Enum("public", "department", "confidential", name="security_level_enum"),
+        default="department",
+        nullable=False
+    )
+    status = Column(String(50), default="active", nullable=False)
+    department_id = Column(String(36), ForeignKey("pjctrl_departments.id"), nullable=True)
+    created_at = Column(DateTime, server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    # Relationships
+    space = relationship("Space", back_populates="projects")
+    owner = relationship("User", foreign_keys=[owner_id], back_populates="owned_projects")
+    department = relationship("Department", back_populates="projects")
+    task_statuses = relationship("TaskStatus", back_populates="project", cascade="all, delete-orphan")
+    tasks = relationship("Task", back_populates="project", cascade="all, delete-orphan")

backend/app/models/space.py

@@ -0,0 +1,20 @@
+from sqlalchemy import Column, String, Text, Boolean, DateTime, ForeignKey
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+from app.core.database import Base
+
+
+class Space(Base):
+    __tablename__ = "pjctrl_spaces"
+
+    id = Column(String(36), primary_key=True)
+    name = Column(String(200), nullable=False)
+    description = Column(Text, nullable=True)
+    owner_id = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=False)
+    is_active = Column(Boolean, default=True, nullable=False)
+    created_at = Column(DateTime, server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    # Relationships
+    owner = relationship("User", back_populates="owned_spaces")
+    projects = relationship("Project", back_populates="space", cascade="all, delete-orphan")

backend/app/models/task.py

@@ -0,0 +1,45 @@
+from sqlalchemy import Column, String, Text, Integer, Boolean, DateTime, Numeric, Enum, ForeignKey
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+from app.core.database import Base
+import enum
+
+
+class Priority(str, enum.Enum):
+    LOW = "low"
+    MEDIUM = "medium"
+    HIGH = "high"
+    URGENT = "urgent"
+
+
+class Task(Base):
+    __tablename__ = "pjctrl_tasks"
+
+    id = Column(String(36), primary_key=True)
+    project_id = Column(String(36), ForeignKey("pjctrl_projects.id", ondelete="CASCADE"), nullable=False)
+    parent_task_id = Column(String(36), ForeignKey("pjctrl_tasks.id", ondelete="CASCADE"), nullable=True)
+    title = Column(String(500), nullable=False)
+    description = Column(Text, nullable=True)
+    assignee_id = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=True)
+    status_id = Column(String(36), ForeignKey("pjctrl_task_statuses.id"), nullable=True)
+    priority = Column(
+        Enum("low", "medium", "high", "urgent", name="priority_enum"),
+        default="medium",
+        nullable=False
+    )
+    original_estimate = Column(Numeric(8, 2), nullable=True)
+    time_spent = Column(Numeric(8, 2), default=0, nullable=False)
+    blocker_flag = Column(Boolean, default=False, nullable=False)
+    due_date = Column(DateTime, nullable=True)
+    position = Column(Integer, default=0, nullable=False)
+    created_by = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=False)
+    created_at = Column(DateTime, server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    # Relationships
+    project = relationship("Project", back_populates="tasks")
+    parent_task = relationship("Task", remote_side=[id], back_populates="subtasks")
+    subtasks = relationship("Task", back_populates="parent_task", cascade="all, delete-orphan")
+    assignee = relationship("User", foreign_keys=[assignee_id], back_populates="assigned_tasks")
+    creator = relationship("User", foreign_keys=[created_by], back_populates="created_tasks")
+    status = relationship("TaskStatus", back_populates="tasks")

backend/app/models/task_status.py

@@ -0,0 +1,33 @@
+from sqlalchemy import Column, String, Integer, Boolean, DateTime, ForeignKey, UniqueConstraint
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+from app.core.database import Base
+
+
+class TaskStatus(Base):
+    __tablename__ = "pjctrl_task_statuses"
+
+    id = Column(String(36), primary_key=True)
+    project_id = Column(String(36), ForeignKey("pjctrl_projects.id", ondelete="CASCADE"), nullable=False)
+    name = Column(String(50), nullable=False)
+    color = Column(String(7), default="#808080", nullable=False)
+    position = Column(Integer, default=0, nullable=False)
+    is_done = Column(Boolean, default=False, nullable=False)
+    created_at = Column(DateTime, server_default=func.now(), nullable=False)
+
+    __table_args__ = (
+        UniqueConstraint('project_id', 'name', name='uk_status_name'),
+    )
+
+    # Relationships
+    project = relationship("Project", back_populates="task_statuses")
+    tasks = relationship("Task", back_populates="status")
+
+
+# Default statuses to create for new projects
+DEFAULT_STATUSES = [
+    {"name": "To Do", "color": "#808080", "position": 0, "is_done": False},
+    {"name": "In Progress", "color": "#0066cc", "position": 1, "is_done": False},
+    {"name": "Blocked", "color": "#cc0000", "position": 2, "is_done": False},
+    {"name": "Done", "color": "#00cc66", "position": 3, "is_done": True},
+]

backend/app/models/user.py

@@ -23,3 +23,9 @@ class User(Base):
     # Relationships
     department = relationship("Department", backref="users")
     role = relationship("Role", backref="users")
+
+    # Task management relationships
+    owned_spaces = relationship("Space", back_populates="owner")
+    owned_projects = relationship("Project", foreign_keys="Project.owner_id", back_populates="owner")
+    assigned_tasks = relationship("Task", foreign_keys="Task.assignee_id", back_populates="assignee")
+    created_tasks = relationship("Task", foreign_keys="Task.created_by", back_populates="creator")