Archive completed tasks, add cleanup commands, self-documenting dashboard UI

- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/
- status.py: add --cleanup-done and --install-cleanup-schedule commands
- Add scripts/automaton-cleanup.sh for periodic task archiving
- Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders
- .rules.md: add Self-Documenting UI Names rule
- New tests: test_cleanup_done.py, expanded test_app.py and test_task.py

tasks/complete/wire-dashboard-config/SPEC.md

@@ -0,0 +1,68 @@
+# Wire DashboardConfig + Add Caching + Add Size Limits
+
+## Goal
+
+Activate the dead `DashboardConfig` module, add basic server-side caching to eliminate redundant disk I/O on every API request, and add input size limits to the review POST endpoint.
+
+## Requirements
+
+### R1. Wire DashboardConfig into the frontend
+
+`dashboard/config.py` defines 5 settings but none are consumed by the server or client. `self.config` is loaded at `ui/app.py:323` and immediately abandoned.
+
+**Fix**:
+- Add `GET /api/config` endpoint returning `config.to_dict()`
+- Add `PUT /api/config` endpoint accepting `body: dict` and calling `config.save()`
+- On dashboard init (`dashboard.js:466`), fetch `/api/config` and apply:
+  - `auto_refresh_interval` → set polling interval (default 2s)
+  - `default_view` → switch to board/stats/timeline on load
+  - `theme` → set CSS `data-theme` attribute
+  - `show_timelines` → show/hide timeline elements
+  - `column_width` → set CSS `--col-min-width` variable
+- Remove hardcoded `setInterval(refreshData, 2000)` on line 462 and use config value
+
+### R2. Add server-side caching for task scans
+
+Currently every `/api/tasks`, `/api/task/{name}`, and `/api/review-summary` call does a full `discover_tasks()` — reading all artifact files from disk. At 2s polling, this is thousands of file reads per minute for ~84KB of data.
+
+**Fix**:
+- Add a module-level cache with TTL (e.g., 1 second or triggered by review writes)
+- `/api/tasks` returns cached data within TTL window
+- `/api/task/{name}` looks up task by name from cached list instead of re-scanning
+- Writing a review (`/api/task/{name}/review` POST) invalidates the cache
+- Cache stores the list of `Task` objects, not the serialized JSON
+
+### R3. Add input size limits to review POST
+
+`ui/app.py:250-263` reads `content_length` from the header and reads the full body with no bounds check. A malicious client can:
+- Send `Content-Length: 999999999` and never send the body → blocks single-threaded server (DoS)
+- Send a 10MB comment → writes 10MB to REVIEW.md (disk abuse)
+
+**Fix**:
+- Add `MAX_POST_BODY = 65536` (64KB) constant
+- If `content_length > MAX_POST_BODY`, return 413 Payload Too Large
+- If `content_length <= 0`, return 400 Bad Request
+- Cap `comment` to 4096 characters before writing to disk
+
+### R4. Add `/api/task/{name}` to use cache
+
+`_serve_task()` at `ui/app.py:170-195` calls `discover_tasks()` to find one task. Use the cache from R2 for O(1) lookup.
+
+## Acceptance Criteria
+
+- [ ] `GET /api/config` returns current config as JSON
+- [ ] `PUT /api/config` with `{"theme": "dark"}` persists to `dashboard-config.json`
+- [ ] Dashboard JS reads config on init and applies theme, default_view, auto_refresh_interval
+- [ ] Changing config via dashboard-config.json and restarting dashboard applies the settings
+- [ ] `/api/tasks` within TTL returns cached data (no disk reads on second poll)
+- [ ] Writing a review via POST invalidates cache; next `/api/tasks` re-reads from disk
+- [ ] POST with `Content-Length: 1000000` returns 413
+- [ ] POST with comment > 4096 chars truncates to 4096 before writing
+- [ ] `test_config.py` tests still pass
+- [ ] `test_app.py` tests still pass
+
+## Non-Goals
+
+- Not implementing persistent caching (disk/memcached) — in-memory TTL is sufficient
+- Not adding authentication to config endpoints (config changes require local access by design)
+- Not optimizing `discover_tasks()` itself — the cache removes the hot path