chore: capture v1 review follow-ups as backlog tasks

@@ -0,0 +1,18 @@
+---
+id: TASK-001
+title: dots auth accepts widget tokens as valid
+status: "\U0001F7E6 Backlog"
+assignee: []
+created_date: '2026-07-30 01:23'
+labels:
+  - bug
+dependencies: []
+priority: medium
+ordinal: 1000
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+auth verifies via GET /api/widget/data, which accepts both widget and CLI tokens — pasting a widget token 'links' successfully, then every write 401s. Verify against a CLI-only endpoint or document.
+<!-- SECTION:DESCRIPTION:END -->

@@ -0,0 +1,18 @@
+---
+id: TASK-002
+title: 'Allow 24:00 as range end in time syntax'
+status: "\U0001F7E6 Backlog"
+assignee: []
+created_date: '2026-07-30 01:23'
+labels:
+  - feature
+dependencies: []
+priority: low
+ordinal: 2000
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+23:00-24:00 currently rejected (24:00 invalid as a time); end-of-day range needs awkward 23:00-23:59. Allow 24:00 as range end only.
+<!-- SECTION:DESCRIPTION:END -->

@@ -0,0 +1,18 @@
+---
+id: TASK-003
+title: Follow-ups in Dots repo from v1 review
+status: "\U0001F7E6 Backlog"
+assignee: []
+created_date: '2026-07-30 01:23'
+labels:
+  - chore
+dependencies: []
+priority: low
+ordinal: 3000
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+Tracked here because Dots repo has no backlog: (1) settings components (ScriptableWidgetSettings + CliTokenSettings) swallow fetch/generate/revoke errors, no error UI; (2) copy-feedback setTimeout not cleaned on unmount (both components); (3) resolveSubscribedUserId session branch duplicates getSubscribedUserId (drift risk); (4) route tests for both auth kinds per spec (repo has no test runner); (5) narrow middleware /api/days/(.*) matcher to blocks+notes if tightening.
+<!-- SECTION:DESCRIPTION:END -->