feat: Bao/Iris-Statusrechte + Bao→Iris-Notifications + Agent-Workflow-Übersicht

- Bao darf jetzt Status ändern (neben Iris), Sub-Agents weiterhin nicht
- CanEditContent für Inhaltsbearbeitung durch alle bekannten Caller
- Bao-Content-Änderungen triggern task_content_changed-Notification an Iris
- Bao-Status-Änderungen triggern task_status_changed-Notification an Iris
- Iris-Status-Änderungen triggern task_status_changed-Notification an Bao
- Neue WorkTask-Felder: IsAgentTask (bool), ExpectedFrom (string)
- Agent-Workflow-API: CreateAgentTask, WaitingTasks, AgentOverview
- Frontend: Agent-Task-Badge, Iris-Overview-Panel, isBao-Getter
- Login-Rate-Limiter mit strukturiertem JSON-Fehlermeldungs-Body
- Volume-Name: nexus-postgres → postgres-data (Standardisierung)

backend/Models/Dashboard.cs

@@ -89,7 +89,9 @@ public sealed record DashboardTaskDto(
     Guid? ParentTaskId,
     DateTimeOffset? DueDate,
     DateTimeOffset CreatedAt,
-    DateTimeOffset UpdatedAt
+    DateTimeOffset UpdatedAt,
+    bool IsAgentTask = false,
+    string? ExpectedFrom = null
 );
 
 public sealed record CreateDashboardTaskRequest(
@@ -101,6 +103,16 @@ public sealed record CreateDashboardTaskRequest(
     Guid? ParentTaskId = null
 );
 
+public sealed record CreateAgentTaskRequest(
+    string Title,
+    string? Detail,
+    string? Source,
+    string? Priority,
+    string? AssignedTo,
+    string? ExpectedFrom,
+    Guid? ParentTaskId = null
+);
+
 public sealed record UpdateDashboardTaskRequest(
     string? Title,
     string? Detail,
@@ -121,7 +133,7 @@ public sealed record AgentActivityEntry(
 
 // ── Task Board DTOs ──
 
-public sealed record TaskBoardResponse(
+public sealed record BoardResponse(
     List<DashboardTaskDto> Offen,
     List<DashboardTaskDto> InProgress,
     List<DashboardTaskDto> Delegated,
@@ -147,6 +159,20 @@ public sealed record PostActivityRequest(
     string? Type = null
 );
 
+// ── Agent Workflow DTOs ──
+
+/// <summary>
+/// Overview of the agent workflow state, grouping tasks by expected respondent
+/// and highlighting stale tasks. Used by Iris to see who she is waiting for.
+/// </summary>
+public sealed record AgentWorkflowOverview(
+    List<DashboardTaskDto> WaitingForBao,
+    List<DashboardTaskDto> WaitingForIris,
+    List<DashboardTaskDto> WaitingForOthers,
+    List<DashboardTaskDto> StaleTasks,
+    TimeSpan StaleThreshold
+);
+
 // ── Notification DTOs ──
 
 public sealed record NotificationDto(