feat: harden auth for public deploy + gantt, duration units, docker packaging

Security (fail-secure for production):
- Refuse to start without PPM_PASSWORD/PPM_PASSWORD_HASH unless
  PPM_ALLOW_NO_AUTH=1 (local dev only)
- Add login rate limiting (5 failures / 60s per client), enforced inside
  SessionManager.login so it cannot be bypassed at the endpoint layer
- compose defaults PPM_COOKIE_SECURE=true for HTTPS behind reverse proxy
- Add .dockerignore to keep runtime data/out of the image

Features:
- Task timeline gantt on home page (week/month zoom, horizontal scroll,
  infinite-arrow for open-ended dates, CSS Grid layout)
- Duration metrics gain a second/minute/hour unit for input & display
  (canonical storage stays integer seconds)
- Per-metric progress bars on home page (no more merged average)
- Backfill historical records via date picker in the today-record card
- Admin panel: stats overview, JSON import/restore, full task list mgmt

Fixes:
- Nullable task startDate; summarize handles missing start date
- Task dialog cancel/close no longer submits the form
- Import validates whole backup first, rejects path traversal, rebuilds
  archives, and replaces stale files

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/main.py

@@ -132,8 +132,11 @@ def create_app(
         return response
 
     @app.post("/api/auth/login")
-    async def login(payload: LoginInput) -> JSONResponse:
-        result = session_manager.login(payload.password)
+    async def login(payload: LoginInput, request: Request) -> JSONResponse:
+        client_key = request.client.host if request.client else ""
+        if session_manager.is_login_locked(client_key):
+            return JSONResponse({"detail": "尝试次数过多，请稍后再试"}, status_code=429)
+        result = session_manager.login(payload.password, client_key)
         if result is None:
             return JSONResponse({"detail": "密码错误"}, status_code=401)
         session_id, session = result
@@ -228,6 +231,15 @@ def create_app(
     async def run_archive() -> dict:
         return {"closedDays": repository.close_missed_days()}
 
+    @app.get("/api/admin/stats")
+    async def admin_stats() -> dict:
+        return repository.stats()
+
+    @app.post("/api/admin/import")
+    async def admin_import(payload: dict) -> dict:
+        count = repository.import_all(payload)
+        return {"imported": count}
+
     return app