feat: complete frozen MVP — period-aware stats, layout-driven UI, quick checkin

- Fix first daily record 422 (expectedVersion now accepts 0)
- Add period_window + summarize; /api/summary and /api/tasks/{id}/summary
  aggregate each metric inside its own day/week/month/lifetime window,
  reading raw facts only (never the rebuildable month archives)
- Drive frontend rendering from per-page layout JSON with a component
  registry; scope/cardinality enforced server-side, invalid layouts fall back
- Add quick checkin and duration input in H:M:S that round-trips integer seconds
- Fix heatmap/completedAt timezone drift to Asia/Shanghai
- Add server-side session TTL (30d) matching the login cookie
- Handle date.min/date.max boundaries without OverflowError
- Half-up rounding to match browser Math.round

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_api.py

@@ -19,6 +19,29 @@ def test_api_crud_order_layout_and_daily(client):
     assert client.get(f"/api/tasks/{task['taskId']}/history?start=2026-08-20&end=2026-08-20").json()["records"]
 
 
+def test_summary_endpoints(client):
+    task = client.post("/api/tasks", json=payload("周期任务")).json()
+    metric_id = task["metrics"][0]["metricId"]
+    client.put(f"/api/tasks/{task['taskId']}/daily/2026-08-20", json={"expectedVersion": 0, "values": [{"metricId": metric_id, "value": 1}]})
+
+    scoped = client.get(f"/api/tasks/{task['taskId']}/summary?date=2026-08-20").json()
+    assert scoped["tasks"][task["taskId"]]["metrics"][0]["value"] == 1
+    assert scoped["tasks"][task["taskId"]]["today"]["recorded"] is True
+
+    assert client.get("/api/summary?date=2026-08-21").json()["tasks"][task["taskId"]]["metrics"][0]["value"] == 0
+
+
+def test_first_daily_write_is_accepted(client):
+    task = client.post("/api/tasks", json=payload("首次记录")).json()
+    metric_id = task["metrics"][0]["metricId"]
+    current = client.get(f"/api/tasks/{task['taskId']}/daily/2026-08-20").json()
+    saved = client.put(
+        f"/api/tasks/{task['taskId']}/daily/2026-08-20",
+        json={"expectedVersion": current["version"], "values": [{"metricId": metric_id, "value": 1}]},
+    )
+    assert saved.status_code == 200, saved.text
+
+
 def test_invalid_input_and_auth(auth_client):
     assert auth_client.get("/api/tasks").status_code == 401
     login = auth_client.post("/api/auth/login", json={"password": "secret"}); assert login.status_code == 200