Harden SecureTaskOps dates and HTTP boundaries

[Assembler-Fourier]

What changed

• make date defaults deterministic against the supplied clock
• validate date-only values and distinguish overdue from due-soon work
• enforce bounded request bodies and safe malformed-JSON responses
• add CSP, no-store and browser hardening headers
• add real HTTP integration tests, architecture/security updates, pinned CI and a lockfile

Verification

• syntax checks
• npm test (13 passed)
• QA Lab isolated API/UI/a11y suite (13 passed)
• npm audit (0 vulnerabilities)

Limitations

The service uses deterministic in-memory sample data and is not durable multi-user infrastructure.