Let a tasks widget have a custom on-panel name

Adds TaskWidgetConfig.name (migration 19, plain column add) shown at
the top of the widget on the actual panel instead of the hardcoded
"Tasks" header -- e.g. "Chores" or "Mom's list". The only widget type
with its own on-panel title at all, since it's the only one where
"which list is this" isn't already obvious from a calendar/photo/
whiteboard's own content.

Threaded through calendar_render's _draw_tasks/_build_tasks/
render_tasks/render_tasks_preview_png as a `title` param (default
"Tasks", truncated to fit -- a long custom name shouldn't be able to
overflow the widget's box), the config-save endpoint (tasks_name,
truncated server-side to a sane header length rather than rejected),
and a new "Settings" section in the tasks dialog.

Verified live in the browser: the name actually renders at the top of
the real composited panel (not just the dialog preview, which stays
gated on having a configured source), and persists correctly on both
desktop and mobile. Full suite (196 tests) passes.

server/tests/test_widget_config_and_queue_endpoints.py

@@ -98,15 +98,31 @@ def test_config_save_updates_a_tasks_widget(client, db_session):
 
     resp = client.post(
         f"/api/frames/1/widgets/{widget.id}/config",
-        data={"tasks_show_completed": "true"},
+        data={"tasks_name": "Chores", "tasks_show_completed": "true"},
         headers=csrf_headers(client),
     )
     assert resp.status_code == 200, resp.text
 
     cfg = db_session.get(TaskWidgetConfig, widget.id)
+    assert cfg.name == "Chores"
     assert cfg.show_completed is True
 
 
+def test_config_save_truncates_an_overlong_tasks_name(client, db_session):
+    client.post("/setup", data={"username": "alice", "password": "hunter22"})
+    widget = _add_tasks_widget(db_session)
+
+    resp = client.post(
+        f"/api/frames/1/widgets/{widget.id}/config",
+        data={"tasks_name": "A" * 200},
+        headers=csrf_headers(client),
+    )
+    assert resp.status_code == 200, resp.text
+
+    cfg = db_session.get(TaskWidgetConfig, widget.id)
+    assert len(cfg.name) == 40
+
+
 def test_config_save_only_partially_updates_provided_fields(client, db_session):
     """Fields not present in the POST are left untouched -- the whole
     point of the partial-update convention (each dialog's own form only