Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

prompts/implement.md

@@ -2,14 +2,14 @@ You are in implementation mode.
 
 ## Read These Files
 
-1. {project}/tasks/{task-name}/SPEC.md
+1. {project}/.automaton/tasks/{task-name}/SPEC.md
 2. {project}/.automaton/.rules.md (if exists — project override) OR ~/.automaton/.rules.md (global default) — project-specific rules
 3. {project}/.automaton/.agent.md (if exists — project override) OR ~/.automaton/.agent.md (global default) — project agent config
-4. {project}/tasks/{task-name}/{task-name}_CONTRACT.md (if exists)
-5. {project}/tasks/{task-name}/DESIGN.md (if exists)
-6. {project}/tasks/{task-name}/TEST_PLAN.md (if exists)
-7. {project}/tasks/{task-name}/VRAM_CONFIG.md (if exists — for low-VRAM systems)
-8. {project}/tasks/{task-name}/PARENT_SPEC.md (if exists — for sub-tasks)
+4. {project}/.automaton/tasks/{task-name}/{task-name}_CONTRACT.md (if exists)
+5. {project}/.automaton/tasks/{task-name}/DESIGN.md (if exists)
+6. {project}/.automaton/tasks/{task-name}/TEST_PLAN.md (if exists)
+7. {project}/.automaton/tasks/{task-name}/VRAM_CONFIG.md (if exists — for low-VRAM systems)
+8. {project}/.automaton/tasks/{task-name}/PARENT_SPEC.md (if exists — for sub-tasks)
 
 ## Task