Add multi-user auth, background generation, and chat UX improvements

Phase 5: Multi-user authentication with session cookies, bcrypt passwords,
first-user-is-admin pattern, per-user data isolation, backup/restore,
Docker Swarm production stack with secrets and network isolation.

Phase 5.1: Chat UX improvements:
- Background generation architecture (GenerationBuffer + asyncio task)
  with SSE fan-out, reconnect support, and periodic DB flushes
- LLM-generated conversation titles (first exchange + every 10th message)
- Stop generation button with cancel_event and partial content preservation
- Relative timestamps in sidebar (5m ago, 3h ago, then dates)
- Empty chat auto-cleanup on navigation away
- Save-as-note uses LLM for title generation, tags notes with "chat"
- Summarize-as-note also tags with "chat"

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/fabledassistant/routes/tasks.py

@@ -2,6 +2,7 @@ from datetime import date
 
 from quart import Blueprint, jsonify, request
 
+from fabledassistant.auth import login_required, get_current_user_id
 from fabledassistant.models.note import TaskPriority, TaskStatus
 from fabledassistant.services.notes import (
     create_note,
@@ -16,7 +17,9 @@ tasks_bp = Blueprint("tasks", __name__, url_prefix="/api/tasks")
 
 
 @tasks_bp.route("", methods=["GET"])
+@login_required
 async def list_tasks_route():
+    uid = get_current_user_id()
     q = request.args.get("q")
     tag = request.args.getlist("tag")
     status = request.args.get("status")
@@ -27,6 +30,7 @@ async def list_tasks_route():
     offset = request.args.get("offset", 0, type=int)
 
     tasks, total = await list_notes(
+        uid,
         q=q,
         tags=tag or None,
         is_task=True,
@@ -41,7 +45,9 @@ async def list_tasks_route():
 
 
 @tasks_bp.route("", methods=["POST"])
+@login_required
 async def create_task_route():
+    uid = get_current_user_id()
     data = await request.get_json()
     body = data.get("body", "") or data.get("description", "")
     tags = extract_tags(body)
@@ -56,6 +62,7 @@ async def create_task_route():
     )
 
     task = await create_note(
+        uid,
         title=data.get("title", ""),
         body=body,
         status=status,
@@ -67,15 +74,19 @@ async def create_task_route():
 
 
 @tasks_bp.route("/<int:task_id>", methods=["GET"])
+@login_required
 async def get_task_route(task_id: int):
-    task = await get_note(task_id)
+    uid = get_current_user_id()
+    task = await get_note(uid, task_id)
     if task is None:
         return jsonify({"error": "Task not found"}), 404
     return jsonify(task.to_dict())
 
 
 @tasks_bp.route("/<int:task_id>", methods=["PUT"])
+@login_required
 async def update_task_route(task_id: int):
+    uid = get_current_user_id()
     data = await request.get_json()
     fields = {}
     for key in ("title", "status", "priority"):
@@ -96,14 +107,16 @@ async def update_task_route(task_id: int):
     if "body" in fields:
         fields["tags"] = extract_tags(fields["body"])
 
-    task = await update_note(task_id, **fields)
+    task = await update_note(uid, task_id, **fields)
     if task is None:
         return jsonify({"error": "Task not found"}), 404
     return jsonify(task.to_dict())
 
 
 @tasks_bp.route("/<int:task_id>/status", methods=["PATCH"])
+@login_required
 async def patch_task_status(task_id: int):
+    uid = get_current_user_id()
     data = await request.get_json()
     status_val = data.get("status")
     if not status_val:
@@ -114,15 +127,17 @@ async def patch_task_status(task_id: int):
     except ValueError:
         return jsonify({"error": f"Invalid status: {status_val}"}), 400
 
-    task = await update_note(task_id, status=status_val)
+    task = await update_note(uid, task_id, status=status_val)
     if task is None:
         return jsonify({"error": "Task not found"}), 404
     return jsonify(task.to_dict())
 
 
 @tasks_bp.route("/<int:task_id>", methods=["DELETE"])
+@login_required
 async def delete_task_route(task_id: int):
-    deleted = await delete_note(task_id)
+    uid = get_current_user_id()
+    deleted = await delete_note(uid, task_id)
     if not deleted:
         return jsonify({"error": "Task not found"}), 404
     return "", 204