feat(polish): close all 6 review nitpicks in one sweep

closes board-viewer-polish

- M1 src/parser.ts: comment explaining why **Status:** text field is intentionally
  ignored (emoji is canonical, prevents future-reader head-scratch)
- M2 src/render.ts + tests: clamp future ISO to '0m' (server clock drift safety)
  + inline comment + test
- M3 .tasks/board-viewer-gitea-reader.md: decisions-log clarifying orphan
  per-task files are out of scope by design (STATUS.md = index of record)
- M4 static/board.{js,css} + src/render.ts: filter rebuilt to query records
  (not DOM badge text); 5 status-filter pill buttons in header with active
  toggle state; smoke-verified blocked filter
- M5 deploy/Dockerfile.build: HEALTHCHECK (file fresher than 2×tick) and
  stderr redirect for failures with timestamp
- M6 src/reader.ts: parallelize getLatestCommitIso per-repo via Promise.all
  (preserves block order)

49 tests pass (was 43 pre-polish), typecheck clean, smoke against real Gitea
returns 81 records from 4 repos.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/reader.ts

@@ -32,9 +32,15 @@ export async function readBoard(
     if (status === null) continue;
 
     const blocks = parseStatus(status);
-    for (const block of blocks) {
+    // Parallel fan-out for per-task commit-iso fetches. Preserves block order
+    // because Promise.all resolves arrays positionally.
+    const isoList = await Promise.all(
+      blocks.map((b) => client.getLatestCommitIso(owner, repo, `.tasks/${b.slug}.md`)),
+    );
+
+    for (let i = 0; i < blocks.length; i++) {
+      const block = blocks[i]!;
       const taskPath = `.tasks/${block.slug}.md`;
-      const last_commit_iso = await client.getLatestCommitIso(owner, repo, taskPath);
       records.push({
         slug: block.slug,
         project: repo,
@@ -46,7 +52,7 @@ export async function readBoard(
         next_action: block.next_action,
         blocker: block.blocker,
         branch: block.branch,
-        last_commit_iso,
+        last_commit_iso: isoList[i]!,
         raw_url: client.rawUrl(owner, repo, taskPath),
       });
     }