feat: @-mention autocomplete; consultant bounty-board access; clickable atomization tasks

- @-mentions: typing "@" in task comments, the messages composer and the chat
  widget now opens a user picker (new shared mention.js) that inserts "@Name ".
  Backed by the existing /api/v1/users search; menus de-dupe per field.
- Consultants can now open the bounty board (read-only): nav link + page/API
  access extended to consultants, board visibility resolves their assigned
  customers, and cards show "Open" instead of claim actions for non-developers.
- Atomization board task titles (roots and subtasks) link to /tasks/{id} so
  consultants can reach the detail view (comments, assignment, timeline).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/static/js/chat-widget.js

@@ -3,6 +3,7 @@
 // plain-text composer. Reuses the conversations API + live WS channel.
 import { api } from '/static/js/api.js';
 import { subscribe, onPollFallback } from '/static/js/ws.js';
+import { attachMentions } from '/static/js/mention.js';
 
 if (document.body.dataset.loggedIn === '1' && location.pathname !== '/messages') {
   let meId = '';
@@ -117,9 +118,12 @@ if (document.body.dataset.loggedIn === '1' && location.pathname !== '/messages')
     } catch (e) { input.value = text; }
   }
   panel.querySelector('#cw-send').addEventListener('click', send);
-  panel.querySelector('#cw-input').addEventListener('keydown', (e) => {
+  const cwInput = panel.querySelector('#cw-input');
+  cwInput.addEventListener('keydown', (e) => {
+    if (cwInput.dataset.mentionActive === '1') return; // mention picker owns Enter
     if (e.key === 'Enter') { e.preventDefault(); send(); }
   });
+  attachMentions(cwInput);
 
   fab.addEventListener('click', async () => {
     open = !open;