Task + goal tracker: private tasks schema, /trackers/tasks page, idempotent seed import (daisy-import)

scripts/deploy-preflight.ts

@@ -129,6 +129,28 @@ try {
 		health.public_usage
 	)
 		throw new Error(`health schema grants are wrong: ${JSON.stringify(health)}`);
+	// Private task tracker: same rules as health (app role read/write, personal_ro none).
+	const [tasks] = await client`
+		select
+			count(*) filter (where has_table_privilege(c.oid, 'select, insert, update, delete')) as app_rw,
+			count(*) filter (
+				where exists (
+					select 1 from aclexplode(c.relacl) a join pg_roles r on r.oid = a.grantee
+					where r.rolname = 'personal_ro'
+				)
+			) as ro_read,
+			count(*) as tables,
+			has_schema_privilege('public', 'tasks', 'usage') as public_usage
+		from pg_class c join pg_namespace n on n.oid = c.relnamespace
+		where n.nspname = 'tasks' and c.relkind = 'r'
+	`;
+	if (
+		Number(tasks.tables) !== 4 ||
+		Number(tasks.app_rw) !== 4 ||
+		Number(tasks.ro_read) !== 0 ||
+		tasks.public_usage
+	)
+		throw new Error(`tasks schema grants are wrong: ${JSON.stringify(tasks)}`);
 	// Energy tracker reads the ned-collector tables (SELECT only).
 	const [energy] = await client`
 		select count(*) as hours, max(valid_from) as latest from energy.ned_utilization
@@ -138,7 +160,7 @@ try {
 	if (!Number(energy.hours))
 		console.warn('Warning: energy.ned_utilization has no hourly data from the last 7 days');
 	console.log(
-		`health: ${health.tables} tables, app read/write, personal_ro none; energy: ${energy.hours} hourly rows, latest ${energy.latest ? new Date(energy.latest).toISOString() : 'none'}`
+		`health: ${health.tables} tables, tasks: ${tasks.tables} tables, app read/write, personal_ro none; energy: ${energy.hours} hourly rows, latest ${energy.latest ? new Date(energy.latest).toISOString() : 'none'}`
 	);
 	const [catalog] = await client`
 		select