Refactor CLI ownership checks and fix bugs from full review

[SatvikPraveen]

Follow-up to #6. Refactors the CLI so ownership checks can't be forgotten, then fixes the bugs a full review of the project found.

Refactor

• Single-task CLI commands (update, complete, delete) look tasks up through TaskManager._find_owned_task(), which only returns the logged-in user's task.
• Login checks use the existing @require_login decorator instead of per-method copies (it was defined but unused).
• This closed a second leak of the same kind: list-tasks while logged out printed every user's tasks.

Security fixes

• Rate-limit bypass: login/register limits were keyed on the client-written X-Forwarded-For, so a new header per request gave unlimited attempts. The limiter now keys on the peer address, and the container trusts forwarded headers only from FORWARDED_ALLOW_IPS (default 127.0.0.1; it was *).
• Username enumeration: a password over 72 bytes made login return 500 for unknown users and 401 for real ones. Registration now rejects such passwords (422), and login cuts input to bcrypt's 72 bytes.
• Refresh race: parallel refreshes of one token each got a new token (5 of 8 in the repro). Revocation is now atomic and happens before issuing.
• Migration accounts: every migrated user got the password <username>@temp123, and JSON tasks could attach to an unrelated existing account with the same name. Accounts now get random one-time passwords, existing usernames are skipped along with their tasks, and the new PUT /api/users/me/password lets users replace the password.

Correctness fixes

• Concurrent registration of one username: 500 → 400.
• PostgreSQL in a non-UTC session returned due dates one day early; SQLite timestamps had no UTC offset.
• null can now clear description/email; required fields reject null.
• Search treats % and _ literally.
• JWT_ALGORITHM is restricted to HMAC algorithms.
• CLI: one send_reminders run locked the user out (last_reminder_date crashed User(**data)).
• CLI: reminders were emailed even when turned off; failed sends were recorded as delivered.
• CLI: unvalidated --due corrupted the data file; bad rows crashed listing and the cron job for every user.
• CLI: tasks.json is written atomically; corrupt files give a clear error.
• CLI: login works without a TTY and honours --email.
• Migration: completed tasks were stamped with the migration time, skewing stats.
• demo_api.py crashed at step 5; the container CLI couldn't write its data.

Verification

• ruff, ruff format --check, mypy, bandit -ll, pip-audit: clean. alembic check: no drift.
• Tests: 101 → 135 passing (2 Redis tests skipped locally), coverage 91.7%. New regression tests are in tests/test_api_hardening.py and tests/test_cli_hardening.py. 31 of the 33 fail on the previous code; the other two guard behaviour that was already correct.
• demo_api.py ran end to end against a live server: all 12 steps, no 500s.
• Docker image builds; task-manager login works in the container without a TTY; the API reports healthy.

Not covered here: the Redis-backed limiter and denylist, which only run in CI's PostgreSQL+Redis job, and behaviour on a real PostgreSQL server in a non-UTC zone (tested by unit test only).