feat: harden auth for public deploy + gantt, duration units, docker packaging

Security (fail-secure for production):
- Refuse to start without PPM_PASSWORD/PPM_PASSWORD_HASH unless
  PPM_ALLOW_NO_AUTH=1 (local dev only)
- Add login rate limiting (5 failures / 60s per client), enforced inside
  SessionManager.login so it cannot be bypassed at the endpoint layer
- compose defaults PPM_COOKIE_SECURE=true for HTTPS behind reverse proxy
- Add .dockerignore to keep runtime data/out of the image

Features:
- Task timeline gantt on home page (week/month zoom, horizontal scroll,
  infinite-arrow for open-ended dates, CSS Grid layout)
- Duration metrics gain a second/minute/hour unit for input & display
  (canonical storage stays integer seconds)
- Per-metric progress bars on home page (no more merged average)
- Backfill historical records via date picker in the today-record card
- Admin panel: stats overview, JSON import/restore, full task list mgmt

Fixes:
- Nullable task startDate; summarize handles missing start date
- Task dialog cancel/close no longer submits the form
- Import validates whole backup first, rejects path traversal, rebuilds
  archives, and replaces stale files

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

compose.yaml

@@ -9,7 +9,10 @@ services:
       PPM_LAYOUT_DIR: /app/config/layouts
       PPM_PASSWORD_HASH: ${PPM_PASSWORD_HASH:-}
       PPM_PASSWORD: ${PPM_PASSWORD:-}
-      PPM_COOKIE_SECURE: ${PPM_COOKIE_SECURE:-false}
+      PPM_COOKIE_SECURE: ${PPM_COOKIE_SECURE:-true}
+      # 生产默认 fail-secure：不配置密码则拒绝启动。
+      # 不要在生产环境打开 PPM_ALLOW_NO_AUTH，仅本地联调可用。
+      PPM_ALLOW_NO_AUTH: ${PPM_ALLOW_NO_AUTH:-false}
     volumes:
       - ppm-data:/app/data
       - ./config/layouts:/app/config/layouts:ro