chore(04-01): Sortable.js bootstrap and soft-danger button CSS

- justfile: add sortable_version := "1.15.7" variable
- justfile: bootstrap downloads sortable.min.js from jsDelivr
- justfile: clean removes static/sortable.min.js
- button.css: add .ui-button-soft-danger-md rule with hover and focus-visible states
- static/sortable.min.js: downloaded at 1.15.7 (45 kB)

backend/internal/web/ui/button.css

@@ -91,3 +91,28 @@
   outline: 2px solid #64748b;
   outline-offset: 2px;
 }
+
+/* Phase 4: Soft-danger button variant for task delete actions. */
+/* Codex concern #7: no CSS nesting — all pseudo-class rules are top-level. */
+
+.ui-button-soft-danger-md {
+  display: inline-flex;
+  align-items: center;
+  border-radius: 0.375rem;
+  background-color: #fee2e2;
+  padding: 0.5rem 1rem;
+  font-size: 1rem;
+  font-weight: 600;
+  color: #b91c1c;
+  border: 1px solid #fecaca;
+  min-height: 44px;
+}
+
+.ui-button-soft-danger-md:hover {
+  background-color: #fecaca;
+}
+
+.ui-button-soft-danger-md:focus-visible {
+  outline: 2px solid #b91c1c;
+  outline-offset: 2px;
+}

backend/justfile

@@ -31,6 +31,7 @@ tailwind_version := "v4.0.0"
 # HTMX version — no runtime CDN reference appears anywhere else (CONTEXT D-10).
 
 htmx_version := "2"
+sortable_version := "1.15.7"
 
 # --- Local config ---------------------------------------------------------------------------
 
@@ -77,6 +78,8 @@ bootstrap:
     # 3. HTMX — bootstrap-time download. This unpkg URL is the explicit allowed exception to
     # the runtime no-CDN rule (CONTEXT D-10); served HTML references only /static/htmx.min.js.
     curl -sSL -o static/htmx.min.js "https://unpkg.com/htmx.org@{{ htmx_version }}/dist/htmx.min.js"
+    # 4. Sortable.js — drag-and-drop library for kanban column reordering.
+    curl -sSL -o static/sortable.min.js "https://cdn.jsdelivr.net/npm/sortablejs@{{ sortable_version }}/Sortable.min.js"
 
 compose-config:
     mkdir -p {{ compose_config_dir }}
@@ -107,7 +110,7 @@ styles-watch:
 
 dev: db-up
     just generate
-    DATABASE_URL='{{ database_url }}' air -c .air.toml
+    DATABASE_URL='{{ database_url }}' SESSION_SECRET=191affeb1624de1f0e07bd5cfab14cd655510a24f7e673bd784ea56847890caf air -c .air.toml
 
 test:
     just generate
@@ -126,5 +129,5 @@ build:
 
 # volume — run `just db-down` first if a full reset is needed.
 clean:
-    rm -rf bin/ tmp/ static/htmx.min.js static/tailwind.css
+    rm -rf bin/ tmp/ static/htmx.min.js static/sortable.min.js static/tailwind.css
     find . -name '*_templ.go' -delete