Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

tests/test_stats.py

@@ -0,0 +1,56 @@
+"""Tests for automaton.dashboard.core.stats."""
+
+from pathlib import Path
+
+import pytest
+
+from automaton.dashboard.core.stats import TaskStats
+from automaton.dashboard.core.task import determine_task_state
+
+
+def _task(name: str, tmp_path: Path, artifacts: dict[str, str]) -> object:
+    from automaton.dashboard.core.task import Task
+
+    task_dir = tmp_path / name
+    task_dir.mkdir(parents=True)
+    for filename, content in artifacts.items():
+        (task_dir / filename).write_text(content)
+    state, artifact_map = determine_task_state(task_dir)
+    return Task(name=name, folder_path=task_dir, state=state, artifacts=artifact_map)
+
+
+def test_empty_stats() -> None:
+    stats = TaskStats([])
+    assert stats.total_tasks == 0
+    assert stats.pass_rate == 0.0
+    assert stats.fail_rate == 0.0
+
+
+def test_counts(tmp_path: Path) -> None:
+    tasks = [
+        _task("done-1", tmp_path, {"VERDICT.md": "## Status: PASS"}),
+        _task("done-2", tmp_path, {"VERDICT.md": "## Status: PASS"}),
+        _task("blocked", tmp_path, {"VERDICT.md": "## Status: FAIL"}),
+        _task("research", tmp_path, {"SPEC.md": "# Spec"}),
+    ]
+    stats = TaskStats(tasks)
+    assert stats.total_tasks == 4
+    assert stats.pass_count == 2
+    assert stats.fail_count == 1
+    assert stats.in_progress_count == 1
+    assert stats.backlog_count == 0
+    assert stats.pass_rate == 50.0
+
+
+def test_sub_task_stats(tmp_path: Path) -> None:
+    from automaton.dashboard.core.task import SubTask, TaskState
+
+    parent = _task("parent", tmp_path, {"SPEC.md": "# Spec"})
+    parent.sub_tasks = [
+        SubTask(name="a", state=TaskState.DONE, has_spec=True, has_verdict=True, verdict_status="PASS"),
+        SubTask(name="b", state=TaskState.BLOCKED, has_spec=True, has_verdict=True, verdict_status="FAIL"),
+    ]
+    stats = TaskStats([parent])
+    assert stats.sub_task_stats == {
+        "parent": {"total": 2, "passed": 1, "failed": 1, "needs_review": 0, "incomplete": 0}
+    }