feat: harden auth for public deploy + gantt, duration units, docker packaging

Security (fail-secure for production):
- Refuse to start without PPM_PASSWORD/PPM_PASSWORD_HASH unless
  PPM_ALLOW_NO_AUTH=1 (local dev only)
- Add login rate limiting (5 failures / 60s per client), enforced inside
  SessionManager.login so it cannot be bypassed at the endpoint layer
- compose defaults PPM_COOKIE_SECURE=true for HTTPS behind reverse proxy
- Add .dockerignore to keep runtime data/out of the image

Features:
- Task timeline gantt on home page (week/month zoom, horizontal scroll,
  infinite-arrow for open-ended dates, CSS Grid layout)
- Duration metrics gain a second/minute/hour unit for input & display
  (canonical storage stays integer seconds)
- Per-metric progress bars on home page (no more merged average)
- Backfill historical records via date picker in the today-record card
- Admin panel: stats overview, JSON import/restore, full task list mgmt

Fixes:
- Nullable task startDate; summarize handles missing start date
- Task dialog cancel/close no longer submits the form
- Import validates whole backup first, rejects path traversal, rebuilds
  archives, and replaces stale files

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

start.bat

@@ -0,0 +1,30 @@
+@echo off
+setlocal
+
+rem Change to the script's own directory
+cd /d "%~dp0"
+
+rem Port: default 8001, override with first arg (e.g. start.bat 9000)
+set "PORT=8001"
+if not "%~1"=="" set "PORT=%~1"
+
+rem Prefer conda ppm env, fall back to system python
+set "PY=D:\ProgramData\miniconda3\envs\ppm\python.exe"
+if not exist "%PY%" set "PY=python"
+
+rem Local-only: allow no-password mode (fail-secure default would refuse to start)
+set "PPM_ALLOW_NO_AUTH=1"
+
+echo ==============================================
+echo   Progress Monitor - dev server (no-auth local)
+echo   URL: http://127.0.0.1:%PORT%
+echo   Stop: press Ctrl+C
+echo ==============================================
+echo.
+
+"%PY%" -m uvicorn app.main:app --host 127.0.0.1 --port %PORT% --reload
+
+rem If uvicorn exits on its own (e.g. port busy / import error), keep the window open
+pause
+
+endlocal