perf(task): offload completion notification fan-out to Asynq worker

POST /api/task-completions/ was spending ~1.5-1.75s synchronously on
APNs push + SMTP email + B2 image fetches inside sendTaskCompletedNotification.
Per-user loop made it scale linearly with residence membership; one image
attached + one residence user is the 1.75s baseline observed in the live
honeydue-eli5-overview Grafana panel.

Replace the inline call (and the fire-and-forget goroutine in QuickComplete,
which violated the project's "no goroutines in handlers" rule) with an
Asynq job:

  - new task type notification:task_completed (worker/scheduler.go)
  - new payload {task_id, completion_id} — IDs only, worker re-reads
    canonical state from Postgres so concurrent edits between enqueue
    and dequeue are reflected
  - new HandleTaskCompletedNotification on jobs.Handler delegates to
    TaskService.SendTaskCompletedNotificationByID
  - new dispatchTaskCompletedNotification in task_service.go picks
    between enqueue (preferred) and inline (fallback) when Redis is
    unreachable or the enqueuer isn't wired (tests / local dev)

Other changes required to wire it up:

  - widen worker.NewTaskClient signature to accept asynq.RedisClientOpt
    so the file-mounted Redis password (audit HIGH-1) can be supplied;
    no prior callers, no breakage
  - extend worker.Enqueuer interface with EnqueueTaskCompletedNotification
  - add TaskEnqueuer field to router.Dependencies; wire from cmd/api/main.go
    with the standard typed-nil interface guard
  - wire a worker-side TaskService in cmd/worker/main.go so the handler
    can use the shared SendTaskCompletedNotificationByID implementation
    (storage service shared with the existing upload-cleanup wiring)

Expected impact on POST /api/task-completions/ p50:
  ~1.75s -> ~120-170ms (DB + tx + Asynq enqueue only)

Notifications still deliver; they just go via the worker instead of in
the request path. MaxRetry=3; "row not found" returns nil so a deleted
task/completion doesn't churn the retry loop.

All 31 test packages pass. No DB migrations.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/router/router.go

@@ -30,6 +30,7 @@ import (
 	"github.com/treytartt/honeydue-api/internal/repositories"
 	"github.com/treytartt/honeydue-api/internal/services"
 	customvalidator "github.com/treytartt/honeydue-api/internal/validator"
+	"github.com/treytartt/honeydue-api/internal/worker"
 	"github.com/treytartt/honeydue-api/pkg/utils"
 )
 
@@ -45,6 +46,11 @@ type Dependencies struct {
 	PushClient        *push.Client // Direct APNs/FCM client
 	StorageService    *services.StorageService
 	MonitoringService *monitoring.Service
+	// TaskEnqueuer is the Asynq client used to push background work onto the
+	// shared Redis queue. Optional — when nil, services that would enqueue
+	// (currently: task-completion notification fan-out) fall back to their
+	// inline implementation. Tests can omit it; production must wire it.
+	TaskEnqueuer worker.Enqueuer
 }
 
 // SetupRouter creates and configures the Echo router
@@ -215,6 +221,13 @@ func SetupRouter(deps *Dependencies) *echo.Echo {
 	taskService.SetEmailService(deps.EmailService)
 	taskService.SetResidenceService(residenceService) // For including TotalSummary in CRUD responses
 	taskService.SetStorageService(deps.StorageService) // For reading completion images for email
+	if deps.TaskEnqueuer != nil {
+		// Offload completion notifications (push + email + B2 image fetches)
+		// to the Asynq worker so POST /api/task-completions/ doesn't pay for
+		// them in the response path. When the enqueuer is absent (tests),
+		// task_service falls back to the inline implementation.
+		taskService.SetTaskCompletedNotificationEnqueuer(deps.TaskEnqueuer)
+	}
 	subscriptionService := services.NewSubscriptionService(subscriptionRepo, residenceRepo, taskRepo, contractorRepo, documentRepo)
 	residenceService.SetSubscriptionService(subscriptionService) // Wire up subscription service for tier limit enforcement