Close the risks that matter before installing things3

[robsquared82]

Why

This fork is the copy that will be built on the Omarchy box and on Grok Bot's VM. Upstream main still has an unauthenticated command server, and a few write paths can hit the wrong object or the wrong account.

GitHub Actions stay disabled on this fork, so merging does not publish a release.

What changed

• things3 webserver refuses to listen, and tiny_http is gone. Grok Bot should run the things3 command directly.
• The history key and password are redacted in Debug and in HTTP error URLs. Commit bodies are logged only when THINGS3_LOG_COMMIT_BODY=1 (the test wrapper sets that).
• Cache and auth files are mode 0600 and are not written or read through a symlink. A saved history key is not reused for a different email.
• A short id that matches more than one task or area is rejected for delete, move, and create. Reorder uses the real history head and returns an error if a commit fails.
• delete of a task sets Trash (tr: true) instead of history op t: 2. Area delete is still a real removal, because areas have no trash flag in this client.
• Recurring templates are refused for move, schedule, and delete. A tag cannot be moved under its own descendant.
• rustls 0.23.45, rustls-webpki 0.103.15, crossbeam-epoch 0.9.21, and quinn-proto 0.11.15.

Tests

cargo test --all-targets and cargo clippy --all-targets -- -D warnings passed on Rust 1.90.

Not in this change

Upstream pull requests #1, #2, evanpurkhiser#5, and evanpurkhiser#11 are not merged. A new Things Cloud account avoids the legacy-id bugs. Do not point this CLI at the early-2010s account.