feat: harden auth for public deploy + gantt, duration units, docker packaging

Security (fail-secure for production):
- Refuse to start without PPM_PASSWORD/PPM_PASSWORD_HASH unless
  PPM_ALLOW_NO_AUTH=1 (local dev only)
- Add login rate limiting (5 failures / 60s per client), enforced inside
  SessionManager.login so it cannot be bypassed at the endpoint layer
- compose defaults PPM_COOKIE_SECURE=true for HTTPS behind reverse proxy
- Add .dockerignore to keep runtime data/out of the image

Features:
- Task timeline gantt on home page (week/month zoom, horizontal scroll,
  infinite-arrow for open-ended dates, CSS Grid layout)
- Duration metrics gain a second/minute/hour unit for input & display
  (canonical storage stays integer seconds)
- Per-metric progress bars on home page (no more merged average)
- Backfill historical records via date picker in the today-record card
- Admin panel: stats overview, JSON import/restore, full task list mgmt

Fixes:
- Nullable task startDate; summarize handles missing start date
- Task dialog cancel/close no longer submits the form
- Import validates whole backup first, rejects path traversal, rebuilds
  archives, and replaces stale files

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/models.py

@@ -20,6 +20,12 @@ class MetricPeriod(str, Enum):
     lifetime = "lifetime"
 
 
+class DurationUnit(str, Enum):
+    second = "second"
+    minute = "minute"
+    hour = "hour"
+
+
 class MetricInput(BaseModel):
     model_config = ConfigDict(extra="forbid", str_strip_whitespace=True)
 
@@ -29,6 +35,7 @@ class MetricInput(BaseModel):
     period: MetricPeriod = MetricPeriod.day
     target: Annotated[int | None, Field(ge=1)] = None
     unit: Annotated[str, Field(max_length=20)] = ""
+    durationUnit: DurationUnit = DurationUnit.minute
 
     @model_validator(mode="after")
     def normalize_metric(self) -> "MetricInput":
@@ -36,7 +43,8 @@ class MetricInput(BaseModel):
             self.target = 1 if self.target is None else self.target
             self.unit = self.unit or "次"
         elif self.kind == MetricKind.duration:
-            self.unit = "秒"
+            # 时长统一以整数秒存储，durationUnit 仅是输入/显示口径。
+            self.unit = ""
         return self
 
 
@@ -45,7 +53,7 @@ class TaskInput(BaseModel):
 
     name: Annotated[str, Field(min_length=1, max_length=120)]
     description: Annotated[str, Field(max_length=2000)] = ""
-    startDate: date
+    startDate: date | None = None
     endDate: date | None = None
     priority: Annotated[int, Field(ge=1, le=5)] = 3
     state: Literal["active", "paused"] = "active"
@@ -53,7 +61,7 @@ class TaskInput(BaseModel):
 
     @model_validator(mode="after")
     def validate_dates_and_metrics(self) -> "TaskInput":
-        if self.endDate and self.endDate < self.startDate:
+        if self.startDate and self.endDate and self.endDate < self.startDate:
             raise ValueError("结束日期不能早于开始日期")
         ids = [metric.metricId for metric in self.metrics if metric.metricId]
         if len(ids) != len(set(ids)):