feat(backend): books, tasks, calendar feed, time tracking, profiles, admin API

- Schema: books, tasks (book/page links, status, priority, due_at),
  time_entries (open entry = running timer), user profile columns
  (avatar, locale, theme, bg_image, bg_blur)
- Books CRUD; pages can live in a book (book_id, validated same-workspace)
- Tasks CRUD with status filter and due_at range query for the calendar
- Time API: start (409 if running), stop (computes duration), list with
  open timer, update, delete
- Users: fuzzy discovery for invites, PATCH /me profile/appearance,
  password change; members list now includes avatars
- Admin API (is_admin guard): overview counts, user list, grant/revoke
  admin, delete user (self-demote/delete blocked)

backend/src/index.js

@@ -11,6 +11,10 @@ import setupRoutes, { isInstalled } from './routes/setup.js';
 import workspaceRoutes from './routes/workspaces.js';
 import pageRoutes from './routes/pages.js';
 import userRoutes from './routes/users.js';
+import bookRoutes from './routes/books.js';
+import taskRoutes from './routes/tasks.js';
+import timeRoutes from './routes/time.js';
+import adminRoutes from './routes/admin.js';
 import { initSocket } from './socket.js';
 
 const app = express();
@@ -43,6 +47,10 @@ app.use('/api/auth', rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }), authRout
 app.use('/api/workspaces', workspaceRoutes);
 app.use('/api/pages', pageRoutes);
 app.use('/api/users', userRoutes);
+app.use('/api/books', bookRoutes);
+app.use('/api/tasks', taskRoutes);
+app.use('/api/time', timeRoutes);
+app.use('/api/admin', adminRoutes);
 
 app.get('/api/health', async (_req, res) => {
   try {