fix/admin dashboard template

[CarmenDou]

Summary by cubic

Fixes due-date timezone shifts in Tasks, tightens workspace RLS, and lets the insforge SDK handle the OAuth callback exchange. Also hides the unfinished Apps nav item.

• Bug Fixes
  • Store tasks.due_date as date (was timestamptz) and parse/render as local dates; update sorting and overdue checks.
  • Keep form values as YYYY-MM-DD; stop converting to ISO strings when saving.
  • Let insforge auto-exchange the OAuth code; remove PKCE verifier storage and manual exchange logic.
  • Workspace RLS: include owners in SELECT so INSERT ... RETURNING works; pin owner_id in UPDATE WITH CHECK to prevent policy bypass.
  • Remove “Apps” from the sidebar until wired up.

^{Written for commit d58439a. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

1 issue found across 8 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[jwfing]

LGTM, approved.