Harden API, data layer, and autosave; add validation, pagination, migrations

- Enforce task ownership on PATCH/DELETE /api/tasks (was: any signed-in
  user could edit or delete anyone's tasks)
- Validate all API request bodies with zod; escape user content and
  restrict links to http(s) in the Drive export; block reverting a
  SUBMITTED report
- Add @@unique([userId, date]) on Report with upsert to eliminate the
  duplicate-daily-report race; switch startup from
  `prisma db push --accept-data-loss` to `prisma migrate deploy` with
  automatic baselining of existing databases (dedup migration merges
  any pre-existing duplicates)
- Autosave: re-queue and retry failed task saves with a visible
  saving/error indicator instead of silently dropping edits
- Paginate and filter GET /api/reports (?date, ?mine, ?q, ?take,
  ?cursor); report form fetches only today's report, admin dashboard
  uses server-side search + Load more
- Type the frontend and lib layer (DTOs in src/types/api.ts); zero
  eslint errors
- Update README and Unraid guide for migrations, upgrade path, and API

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/lib/google-drive.ts

@@ -1,6 +1,11 @@
-import { google } from 'googleapis';
+import { google, Auth } from 'googleapis';
 import { Readable } from 'stream';
 import { prisma } from './prisma';
+import type { Prisma } from '@prisma/client';
+
+type ReportWithRelations = Prisma.ReportGetPayload<{
+  include: { tasks: true; user: true };
+}>;
 
 export async function getGoogleAuth(userId: string) {
   const account = await prisma.account.findFirst({
@@ -50,10 +55,10 @@ export async function getGoogleAuth(userId: string) {
   return auth;
 }
 
-export async function uploadToDrive(auth: any, fileName: string, content: string, folderId?: string) {
+export async function uploadToDrive(auth: Auth.OAuth2Client, fileName: string, content: string, folderId?: string) {
   const drive = google.drive({ version: 'v3', auth });
 
-  const fileMetadata: any = {
+  const fileMetadata: { name: string; mimeType: string; parents?: string[] } = {
     name: fileName,
     mimeType: 'application/vnd.google-apps.document', // Automatically convert to Google Doc
   };
@@ -80,7 +85,7 @@ export async function uploadToDrive(auth: any, fileName: string, content: string
   }
 }
 
-export async function updateDriveFile(auth: any, fileId: string, content: string) {
+export async function updateDriveFile(auth: Auth.OAuth2Client, fileId: string, content: string) {
   const drive = google.drive({ version: 'v3', auth });
 
   const media = {
@@ -101,11 +106,26 @@ export async function updateDriveFile(auth: any, fileId: string, content: string
   }
 }
 
-export function generateReportHTML(report: any) {
+function escapeHtml(value: unknown): string {
+  return String(value ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+// Only allow plain http(s) URLs into href attributes
+function safeLink(link: unknown): string | null {
+  const url = String(link ?? '').trim();
+  return /^https?:\/\//i.test(url) ? url : null;
+}
+
+export function generateReportHTML(report: ReportWithRelations) {
   const dateObj = new Date(report.date);
   const dateStr = dateObj.toLocaleDateString('en-US', { weekday: 'long', year: 'numeric', month: 'long', day: 'numeric' });
-  const plannedTasks = report.tasks.filter((t: any) => t.type === 'PLANNED');
-  const completedTasks = report.tasks.filter((t: any) => t.type === 'COMPLETED');
+  const plannedTasks = report.tasks.filter((t) => t.type === 'PLANNED');
+  const completedTasks = report.tasks.filter((t) => t.type === 'COMPLETED');
 
   const cellStyle = "padding: 10px; border-bottom: 1px solid #e2e8f0; font-family: Arial, sans-serif; font-size: 11pt;";
   const headerStyle = "padding: 12px 10px; background-color: #f1f5f9; border-bottom: 2px solid #cbd5e1; font-family: Arial, sans-serif; font-size: 11pt; font-weight: bold; text-align: left; color: #334155;";
@@ -117,8 +137,8 @@ export function generateReportHTML(report: any) {
         
         <div style="background-color: #f8fafc; padding: 20px; border-left: 4px solid #3b82f6; border-radius: 4px; margin-bottom: 30px; font-family: Arial, sans-serif;">
           <p style="margin: 0 0 8px 0; font-size: 11pt;"><strong>Date:</strong> ${dateStr}</p>
-          <p style="margin: 0 0 8px 0; font-size: 11pt;"><strong>Employee:</strong> ${report.user.name}</p>
-          <p style="margin: 0; font-size: 11pt;"><strong>Manager:</strong> ${report.managerName || 'N/A'}</p>
+          <p style="margin: 0 0 8px 0; font-size: 11pt;"><strong>Employee:</strong> ${escapeHtml(report.user.name)}</p>
+          <p style="margin: 0; font-size: 11pt;"><strong>Manager:</strong> ${escapeHtml(report.managerName || 'N/A')}</p>
         </div>
 
         <h2 style="color: #1e293b; margin-top: 30px; margin-bottom: 15px; font-family: Arial, sans-serif;">Planned Tasks</h2>
@@ -129,11 +149,11 @@ export function generateReportHTML(report: any) {
               <th style="${headerStyle} width: 20%;">Estimate</th>
               <th style="${headerStyle} width: 35%;">Notes</th>
             </tr>
-            ${plannedTasks.map((t: any) => `
+            ${plannedTasks.map((t) => `
               <tr>
-                <td style="${cellStyle}">${t.description}</td>
-                <td style="${cellStyle} color: #64748b;">${t.timeEstimate || '-'}</td>
-                <td style="${cellStyle} color: #64748b;">${t.notes || '-'}</td>
+                <td style="${cellStyle}">${escapeHtml(t.description)}</td>
+                <td style="${cellStyle} color: #64748b;">${escapeHtml(t.timeEstimate || '-')}</td>
+                <td style="${cellStyle} color: #64748b;">${escapeHtml(t.notes || '-')}</td>
               </tr>
             `).join('')}
           </table>
@@ -147,13 +167,16 @@ export function generateReportHTML(report: any) {
               <th style="${headerStyle} width: 20%;">Status</th>
               <th style="${headerStyle} width: 40%;">Work Link</th>
             </tr>
-            ${completedTasks.map((t: any) => `
+            ${completedTasks.map((t) => {
+              const link = safeLink(t.link);
+              return `
               <tr>
-                <td style="${cellStyle}">${t.description}</td>
-                <td style="${cellStyle} font-weight: bold; color: #059669;">${t.status || 'Done'}</td>
-                <td style="${cellStyle}">${t.link ? `<a href="${t.link}" style="color: #2563eb; text-decoration: none;">${t.link}</a>` : '-'}</td>
+                <td style="${cellStyle}">${escapeHtml(t.description)}</td>
+                <td style="${cellStyle} font-weight: bold; color: #059669;">${escapeHtml(t.status || 'Done')}</td>
+                <td style="${cellStyle}">${link ? `<a href="${escapeHtml(link)}" style="color: #2563eb; text-decoration: none;">${escapeHtml(link)}</a>` : '-'}</td>
               </tr>
-            `).join('')}
+            `;
+            }).join('')}
           </table>
         ` : `<p style="font-style: italic; color: #94a3b8; font-family: Arial, sans-serif; margin-bottom: 30px;">No completed tasks reported today.</p>`}