Initial WhatToDo app

Self-hosted personal task list: FastAPI + SQLite in Docker, mobile-friendly
PWA frontend, deadlines, priorities, categories, tags, notes, checklists,
recurring tasks, single-password login, and JSON export/import.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,20 @@
+# Copy to .env and fill in. .env is git-ignored: never commit it.
+
+# Password for logging in to the app.
+APP_PASSWORD=change-me
+# Long random string used to sign login cookies. Generate one with:
+#   head -c 32 /dev/urandom | base64
+SECRET_KEY=change-me
+
+# true when the app is served over HTTPS (production). Keep false for http://localhost.
+COOKIE_SECURE=false
+# How long a login lasts, in days.
+SESSION_DAYS=30
+
+# Port on the host, and which interface to listen on:
+#   127.0.0.1 = only this computer, 0.0.0.0 = also other devices on your network (phone).
+PORT=8080
+BIND_ADDR=127.0.0.1
+
+# Behind a reverse proxy, the IPs allowed to set X-Forwarded-For (for login rate limiting).
+# FORWARDED_ALLOW_IPS=127.0.0.1