feat: add cmd+k command palette

[ulascanzorer]

Summary

Task Reference: [MYMR-191]

Adds a global ⌘K / Ctrl+K command palette that lets any authenticated user jump to projects (across every team they belong to), tasks (across every project they belong to), and the /settings route from any route under AppShell. Replaces the two disabled Jump / Search or jump stubs in TopBar and Sidebar (expanded + compact) with live affordances that open the same palette.

The palette is built from scratch on top of the existing motion + useModalChrome modal primitives (no cmdk dependency, no new packages), with a proper WAI-ARIA combobox + listbox keyboard model: Up/Down/Home/End/Enter/Esc, role=\"combobox\" + role=\"listbox\" + role=\"option\", and aria-activedescendant driving the highlight. Task search is debounced 300 ms and capped at 10 rows per source; the SQL query joins tasks to projects and filters by projects.organizationId IN current_user_orgs() (defense-in-depth on top of RLS).

Stacked on the MYMR-208 branch.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation

Testing

• Tested locally with bun run dev (palette opens via ⌘K + every trigger; arrows / Enter / Esc behave; cross-project task search returns results scoped to the caller's orgs; deep link ?task=<id> selects the task on landing and is stripped from the URL).
• Linting passes (bun run lint)
• Typecheck passes (bun run typecheck)
• New data-layer tests pass (bun test tests/data/task.test.ts): empty / whitespace queries return []; cross-org isolation; taskRef short-circuit; tag substring match. The full suite has one pre-existing failure in tests/realtime/access.test.ts:147 (unrelated to this change; reproducible on the parent branch).

Notes for reviewer

• Task detail route. No URL-addressable task detail route exists today (WorkspaceClient holds selection in component state). The palette deep-links via /project/<id>?task=<taskId>; WorkspaceClient now seeds selectedTaskId from that query param on mount and strips it immediately so back-navigation doesn't re-select stale tasks. Minimal surgical change to keep task-jump useful.
• CompactNavIcon extension. The collapsed sidebar's CompactNavIcon previously only supported disabled rows. Extended with one optional onClick prop; disabled styling is untouched when onClick is absent.
• No setState-in-effect. The project's lint config forbids synchronous setState inside useEffect. The palette uses the prev-tracker render-phase reset pattern (mirrors WorkspaceClient's prevSelectedTaskId) for open/close, debounced-query, and option-list-length resets. The fetch effect only writes via its async transition callback.
• Security. Cross-project search runs inside withUserContext(ctx.userId, ...) AND filters by current_user_orgs(); both layers must be wrong for cross-team leakage. New test covers the cross-org boundary explicitly.