feat: bounty board, task lifecycle, AI work performer flow, notifications (phase 8)

- whitelist HTML sanitizer (stdlib tokenizer) with XSS vector tests
- developer board: pool-scoped visibility, customer/search/minBounty/sort
  filters, stale-task age badges, competing-claims visibility setting,
  saved filters in profile extras
- claims: request/withdraw (developer), approve/decline (consultant) with
  notifications to winners and losers; unassign/abandon back to board
- work tracking: start, sanitized comments with @mention notifications,
  time logging, submit for review
- review queue + review with per-AC checklist stored on the timeline;
  approve writes the immutable bountyAwards row (human assignees only)
- assign-to-AI: §5.2 job submission, HMAC-verified callback endpoint,
  idempotent by jobId, artifacts downloaded into GridFS, failure path
  keeps the task assigned with timeline + notification
- notifications API + bell with unread badge, dropdown, page, WS toasts
- pages: bounty board, my-tasks kanban, task detail (role-driven actions,
  review dialog, AI dialog), review queue, developer pool

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cmd/app/main.go

@@ -24,6 +24,7 @@ import (
 	"bountyboard/internal/metrics"
 	"bountyboard/internal/store"
 	syncpkg "bountyboard/internal/sync"
+	"bountyboard/internal/workperform"
 	"bountyboard/internal/ws"
 )
 
@@ -98,6 +99,12 @@ func run() error {
 	srv.SetAtomizerInfo(atomClient)
 	srv.AddReadinessCheck(httpx.ReadinessCheck{Name: "atomizer", Probe: atomClient.Healthy})
 
+	// Work Performer client — fully independent service (§5).
+	wpClient := workperform.New(func() string { return cfg.WorkPerformerBaseURL },
+		cfg.WorkPerformerToken, cfg.WorkPerformerHTTPTimeout)
+	srv.SetPerformerClient(wpClient)
+	srv.AddReadinessCheck(httpx.ReadinessCheck{Name: "work-performer", Probe: wpClient.Healthy})
+
 	// Background job queue + atomization handlers.
 	runner := jobs.NewRunner(st, log, reg, 4)
 	atomSvc := atomize.NewService(st, atomClient, log, cfg.AppBaseURL,