tasks carry a definition of done and a blocker (V-510)

Migration #22 adds done_when and blocked_on to tasks, both NOT NULL DEFAULT
''. "He has not written one" and "there is nothing to write" are the same
state here, so no caller has to tell NULL from empty.

blocked_on is a canonical Nexus entity id, never a name. It names a person
and identity lives in Nexus, so free text here would be a second answer to a
question Nexus already owns. The caller resolves before it writes.

Both columns round-trip through ipc.TaskAPI: on ipc.Task, settable at intake
through CaptureTaskReq, and writable afterwards through the new
SetTaskFields, which is deliberately not one-way — he may sharpen a
criterion, and a blocker clears when the person answers.

SetTaskStatus now refuses candidate → open when done_when is empty
(ErrTaskNoDoneWhen, mapped across the wire), the same refusal
ParseTaskCapture makes for a capture marker with nothing after it: confirming
work whose finish line nobody wrote is how a board fills with rows that can
never leave it. Dropping such a candidate stays legal, and the /tasks confirm
button now says what is missing instead of surfacing a not-found.

One caller skips the gate. CaptureTask promoting a candidate he stated out
loud would otherwise be denied intake rather than asked for a criterion, and
a direct open capture never carried one either. The gate belongs to the
deliberate promotion on /tasks, where V-511 puts a form.

internal/ipc/api.go

@@ -142,6 +142,11 @@ type Task struct {
 	Weight     int        `json:"weight,omitempty"`
 	Resolved   *time.Time `json:"resolved,omitempty"`
 	ResolvedBy string     `json:"resolved_by,omitempty"`
+	// DoneWhen — the acceptance criterion. Empty until he writes one, and a
+	// candidate with no criterion cannot be promoted to open (Vikunja #510).
+	DoneWhen string `json:"done_when,omitempty"`
+	// BlockedOn — a canonical Nexus entity id, never a name.
+	BlockedOn string `json:"blocked_on,omitempty"`
 }
 
 // CaptureTaskReq — THE INTAKE SEAM. Everything that captures a task goes
@@ -170,6 +175,11 @@ type CaptureTaskReq struct {
 	Due        *time.Time `json:"due,omitempty"`
 	Weight     int        `json:"weight,omitempty"`
 	Ts         time.Time  `json:"ts"`
+	// DoneWhen and BlockedOn are optional at intake. A derived source leaves
+	// both empty: mail says what to do, not what finishing means, and guessing
+	// a criterion would put Maven's reading in the field he is meant to write.
+	DoneWhen  string `json:"done_when,omitempty"`
+	BlockedOn string `json:"blocked_on,omitempty"`
 }
 
 // CaptureTaskResp — Created is false when the same live task already existed,
@@ -539,6 +549,16 @@ type setTaskStatusReq struct {
 	By string `json:"by,omitempty"`
 }
 
+// setTaskFieldsReq — the write for the two board columns. Both are sent every
+// time and both may be empty: clearing a blocker is as ordinary as setting one,
+// so an omitted field cannot mean "leave it alone" without a second way to say
+// "make it empty".
+type setTaskFieldsReq struct {
+	ID        int64  `json:"id"`
+	DoneWhen  string `json:"done_when,omitempty"`
+	BlockedOn string `json:"blocked_on,omitempty"`
+}
+
 // idReq — methods keyed by a single id.
 type idReq struct {
 	ID int64 `json:"id"`
@@ -847,6 +867,11 @@ type unlockReq struct {
 // wire round-tripping via errors.Is).
 var ErrToolNotFound = errors.New("ipc: tool not found")
 
+// ErrTaskNoDoneWhen — a candidate cannot be promoted to open with no
+// definition of done (Vikunja #510). Carried across the wire so the /tasks
+// form can say which refusal it hit rather than "не найдено".
+var ErrTaskNoDoneWhen = errors.New("ipc: task has no definition of done")
+
 // callerKey — context key for the authenticated caller. Server sets it from
 // SO_PEERCRED before dispatch; in-process callers omit it (the adapter treats
 // a missing Caller as "trusted same-process", the equivalent of the socket's