background_tasks: settings form accepts unbounded numeric values and gives no save feedback

[antosubash]

Found by QA on a live app: the BackgroundTasks module settings form accepts retention_days=-5 and max_retries=999999999 — both save with HTTP 200 and persist (silent corruption; values were restored after the test). Numeric fields need ge/le bounds in the settings schema. Additionally, saving valid settings shows no success toast/feedback (P3 UX), and the invite form accepts an obviously invalid email without warning on the 'Send invites' tab.

Pre-existing on main (not related to PR #267); found during its QA cycle.

https://claude.ai/code/session_01HMniW4BEhpumUTFnWZVKVc

[antosubash]

🤖 Claimed. I am creating an isolated worktree from origin/main and starting implementation.

[antosubash]

✅ Draft pull request opened: #279

Implementation summary

• Added bounds: retention_days 1–3650 and max_retries 0–100.
• Invalid values now return 422 without persistence.
• Added “Settings saved” success toast.
• Added pre-submit invite email validation, warning, and disabled submission for invalid addresses.
• Added Python and React regression tests.

Changed areas

• Background task settings schema and documentation.
• Settings module save feedback.
• Users invite form validation.
• Vitest/module test configuration and package metadata.

Verification

• uv run pytest ... — 251 passed.
• npm test -- --run — 110 passed.
• make gen-pages && make lint — passed.
• make doctor — 0 errors; one pre-existing SM003 AuditLog warning.
• git diff --check — passed.

Visual evidence: none; UI behavior covered by component tests.

Risks/blockers: none known.

[antosubash]

⛔ Blocked.

Pi CI repair failed: Visual sandbox requires a private writable runtime directory at /run/user/1000