Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

tasks/add-pytest-test-suite/SPEC.md

@@ -0,0 +1,29 @@
+# SPEC: Add pytest Test Suite
+
+## Goal
+Add automated tests for the dashboard and the new VRAM detection script.
+
+## Requirements
+1. Create `tests/test_scope.py` for scope detection.
+2. Create `tests/test_task.py` for task state determination and sub-task parsing.
+3. Create `tests/test_board.py` for Kanban board grouping and filtering.
+4. Create `tests/test_stats.py` for statistics calculations.
+5. Create `tests/test_config.py` for config validation and defaults.
+6. Create `tests/test_app.py` for dashboard HTTP API endpoints and path-traversal guard.
+7. Create `tests/test_vram_detect.py` for the VRAM detector using mocked system data.
+8. Update `pyproject.toml` with optional dependencies:
+   - `test` extra: `pytest`
+   - `dashboard` extra: `inotify` (optional)
+9. Update `.gitignore` for `.pytest_cache/`.
+
+## Acceptance Criteria
+- [ ] `python -m pytest` discovers and passes all tests.
+- [ ] Tests exercise state determination, filtering, API responses, config validation, and VRAM detection.
+- [ ] `pyproject.toml` includes the optional dependency groups.
+
+## Non-Goals
+- Achieving 100% coverage.
+- Testing shell scripts (handled separately).
+
+## Stop Condition
+When all acceptance criteria are met, output "CONTRACT_MET".