Add side panels, task selection, graph animation, and project docs

- Foldable left panel (user profile) and right panel (task details)
- Clicking a task in the list or graph node selects it and shows details
- Both views (task list + graph) always mounted via absolute inset-0 for
  correct canvas dimensions; tabs toggle visibility with opacity
- Graph node selection animation: other nodes repel outward (charge -600),
  then selected node smoothly slides to center (500ms cubic ease-out),
  then charge restores to -120 and graph stabilizes
- Graph re-fits on tab switch and panel resize via ResizeObserver
- Fix UUID string IDs throughout (backend returns UUIDs, not integers)
- Add TaskDetailPanel, UserPanel components
- Add CLAUDE.md project documentation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/node_modules/next/dist/server/app-render/csrf-protection.js

@@ -0,0 +1,90 @@
+// micromatch is only available at node runtime, so it cannot be used here since the code path that calls this function
+// can be run from edge. This is a simple implementation that safely achieves the required functionality.
+// the goal is to match the functionality for remotePatterns as defined here -
+// https://nextjs.org/docs/app/api-reference/components/image#remotepatterns
+// TODO - retrofit micromatch to work in edge and use that instead
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "isCsrfOriginAllowed", {
+    enumerable: true,
+    get: function() {
+        return isCsrfOriginAllowed;
+    }
+});
+function matchWildcardDomain(domain, pattern) {
+    const domainParts = domain.split(".");
+    const patternParts = pattern.split(".");
+    if (patternParts.length < 1) {
+        // pattern is empty and therefore invalid to match against
+        return false;
+    }
+    if (domainParts.length < patternParts.length) {
+        // domain has too few segments and thus cannot match
+        return false;
+    }
+    let depth = 0;
+    while(patternParts.length && depth++ < 2){
+        const patternPart = patternParts.pop();
+        const domainPart = domainParts.pop();
+        switch(patternPart){
+            case "":
+            case "*":
+            case "**":
+                {
+                    // invalid pattern. pattern segments must be non empty
+                    // Additionally wildcards are only supported below the domain level
+                    return false;
+                }
+            default:
+                {
+                    if (domainPart !== patternPart) {
+                        return false;
+                    }
+                }
+        }
+    }
+    while(patternParts.length){
+        const patternPart = patternParts.pop();
+        const domainPart = domainParts.pop();
+        switch(patternPart){
+            case "":
+                {
+                    // invalid pattern. pattern segments must be non empty
+                    return false;
+                }
+            case "*":
+                {
+                    // wildcard matches anything so we continue if the domain part is non-empty
+                    if (domainPart) {
+                        continue;
+                    } else {
+                        return false;
+                    }
+                }
+            case "**":
+                {
+                    // if this is not the last item in the pattern the pattern is invalid
+                    if (patternParts.length > 0) {
+                        return false;
+                    }
+                    // recursive wildcard matches anything so we terminate here if the domain part is non empty
+                    return domainPart !== undefined;
+                }
+            default:
+                {
+                    if (domainPart !== patternPart) {
+                        return false;
+                    }
+                }
+        }
+    }
+    // We exhausted the pattern. If we also exhausted the domain we have a match
+    return domainParts.length === 0;
+}
+const isCsrfOriginAllowed = (originDomain, allowedOrigins = [])=>{
+    return allowedOrigins.some((allowedOrigin)=>allowedOrigin && (allowedOrigin === originDomain || matchWildcardDomain(originDomain, allowedOrigin)));
+};
+
+//# sourceMappingURL=csrf-protection.js.map