feat: org-scoped tasks backend, wire tasks page

Add the tasks table, validation, service and routes (/api/tasks with a
PATCH for partial updates / the done toggle, RBAC-gated) and the frontend
data module. The tasks board now loads, creates and toggles real data
(optimistic toggle with rollback).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/lib/task-validation.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+
+// Payload accepted by POST /api/tasks (full create).
+export const taskInputSchema = z.object({
+  title: z.string().trim().min(1, "A task subject is required.").max(200),
+  assignee: z.string().trim().max(200).default("Unassigned"),
+  due: z.string().trim().max(120).default("No due date"),
+  priority: z.enum(["high", "medium", "low"]).default("medium"),
+  patient: z.string().trim().max(200).nullish(),
+  notes: z.string().max(5000).nullish(),
+});
+
+// Payload accepted by PATCH /api/tasks/:id — any subset of fields, plus `done`
+// (used by the list/detail toggle).
+export const taskPatchSchema = taskInputSchema.partial().extend({
+  done: z.boolean().optional(),
+});
+
+export type TaskInput = z.infer<typeof taskInputSchema>;
+export type TaskPatch = z.infer<typeof taskPatchSchema>;