Add TickTick integration, MCP server, and dev project tracking

New integration with TickTick API for project/task management:
- OAuth 2.0 auth flow (mcp-servers/ticktick/ticktick_auth.py)
- MCP server with 9 tools for Claude Code (ticktick_mcp.py)
- FastAPI service with SOPS vault credentials (api/services/ticktick_service.py)
- JWT-protected REST router at /api/ticktick/ (api/routers/ticktick.py)
- Credentials stored in SOPS vault (services/ticktick.sops.yaml)

Dev project tracking (hybrid TickTick + DB):
- New dev_projects table migration (14 columns, status index)
- TickTick "Dev Projects" list for mobile visibility
- First project seeded: TickTick Integration (linked both sides)

Security: .tokens.json gitignored, token file permissions restricted,
HTML-escaped OAuth callback, SOPS vault (not env vars) for secrets.

Also: Installed Tailscale on ACG-5070 for office network access.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

migrations/add_dev_projects_table.sql

@@ -0,0 +1,22 @@
+-- Migration: Add dev_projects table for tracking development projects
+-- Syncs with TickTick "Dev Projects" list (id: 69cbd7138f0826bd72746074)
+-- Date: 2026-03-31
+
+CREATE TABLE IF NOT EXISTS dev_projects (
+    id CHAR(36) PRIMARY KEY DEFAULT (UUID()),
+    name VARCHAR(200) NOT NULL,
+    description TEXT,
+    status ENUM('planning', 'active', 'paused', 'completed', 'archived') NOT NULL DEFAULT 'planning',
+    ticktick_task_id VARCHAR(100) DEFAULT NULL,
+    ticktick_project_id VARCHAR(100) DEFAULT '69cbd7138f0826bd72746074',
+    started_at DATETIME DEFAULT NULL,
+    completed_at DATETIME DEFAULT NULL,
+    last_worked_on DATETIME DEFAULT NULL,
+    total_sessions INT DEFAULT 0,
+    tags JSON DEFAULT NULL,
+    notes TEXT,
+    created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_dev_projects_status ON dev_projects(status);