Security audit, bug fixes, auto-save, and writing assistant improvements

Backend security & correctness:
- Add rate_limit.py: sliding-window rate limiter (asyncio) applied to login,
  register, forgot/reset password endpoints (10/60s or 5/300s per IP)
- app.py: add security headers in after_request (X-Frame-Options, CSP,
  X-Content-Type-Options, Referrer-Policy) using setdefault to preserve SSE headers
- auth.py: refactor duplicate login_required/admin_required into shared _check_auth()
- config.py: add TRUST_PROXY_HEADERS for proxy-aware client IP resolution
- routes/auth.py: rate limiting, _client_ip() helper, cleaned-up reset_password route
- routes/chat.py, notes.py, tasks.py: int() DoS fix on last_event_id; limit capped
  at 500; date.fromisoformat() wrapped in try/except → 400 on invalid dates
- services/auth.py: fix Setting.user_id update bug (filter on NULL not user.id);
  reset_password_with_token returns int|None (user_id) instead of bool
- services/backup.py: add _security_notice to full backup JSON export
- services/assist.py: system prompt explicitly preserves markdown list structure
  and nested indented sub-items

Infrastructure:
- docker-compose.yml: add healthcheck on app service (/api/health, 10s interval)
- .dockerignore: prevent secrets/node_modules/__pycache__/.env.* leaking into build

Frontend bug fixes:
- TaskCard.vue, TaskViewerView.vue: fix isOverdue() timezone bug (ISO string compare)
- useAssist.ts: accept() now resets state to idle when document changed since proposal
- stores/chat.ts: fix memory leak in _pollUntilLoaded() (try/catch around fetchStatus)
- TiptapEditor.vue: selection offset uses closest-match strategy (not first-match)
- utils/markdown.ts: explicit DOMPurify config with FORCE_BODY; remove as const
  (DOMPurify expects mutable string[])

New features:
- Auto-save (5-minute interval) in NoteEditorView and TaskEditorView — only when
  editing an existing dirty record; silent on error, shows "Auto-saved" toast
- sectionParser.ts: top-level bullet/numbered list items are now individual sections
  in the AI Assist panel (previously treated as one undifferentiated block)
- editor-shared.css: extracted ~500 lines of CSS duplicated between both editors;
  includes .inline-assist-btn at global scope (required for teleported elements)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/fabledassistant/auth.py

@@ -5,7 +5,7 @@ from quart import g, jsonify, session
 from fabledassistant.services.auth import get_user_by_id
 
 
-def login_required(f):
+def _check_auth(f, required_role: str | None = None):
     @functools.wraps(f)
     async def decorated(*args, **kwargs):
         user_id = session.get("user_id")
@@ -15,27 +15,20 @@ def login_required(f):
         if not user:
             session.clear()
             return jsonify({"error": "Authentication required"}), 401
-        g.user = user
-        return await f(*args, **kwargs)
-    return decorated
-
-
-def admin_required(f):
-    @functools.wraps(f)
-    async def decorated(*args, **kwargs):
-        user_id = session.get("user_id")
-        if not user_id:
-            return jsonify({"error": "Authentication required"}), 401
-        user = await get_user_by_id(user_id)
-        if not user:
-            session.clear()
-            return jsonify({"error": "Authentication required"}), 401
-        if user.role != "admin":
+        if required_role and user.role != required_role:
             return jsonify({"error": "Admin access required"}), 403
         g.user = user
         return await f(*args, **kwargs)
     return decorated
 
 
+def login_required(f):
+    return _check_auth(f)
+
+
+def admin_required(f):
+    return _check_auth(f, required_role="admin")
+
+
 def get_current_user_id() -> int:
     return g.user.id