feat(handbook): add task-overview section rendered from mounted CSV (#662)

[TaprootFreak]

Implements the RealUnitCH/app half of #662 — the presentation layer only. Edits a single file, docs/handbook/de/index.html.

The private data + nginx mount (tasks.csv, docker-compose volume, deploy) live in the server repo and are handled separately (DFXServer/server #332). No task data is added to this repo.

What this PR adds

1. Nav entry — A · Aufgaben after the existing appendix entries (M / S / L).
2. Section — a new <details id="spec-tasks" class="spec"> matching the handbook look (spec-head, spec-intro, palette variables), containing a #tasks-table mount point and an inline renderer.
3. CSS — a small #spec-tasks table/notice block reusing the existing palette (--surface, --line, --surface-2, …).

Renderer behaviour

• fetch('tasks.csv') — relative URL resolves same-origin to /de/tasks.csv (browser replays the existing Basic-Auth session; no extra auth handling).
• Header-driven, RFC-4180-aware parser: handles quoted fields with commas, ""-escaped quotes, and LF/CRLF line endings. Built entirely with DOM APIs (createElement + textContent), so every cell value is HTML-escaped by construction.
• First row → <th>; remaining rows → <tr>/<td>. Status columns (Code/Test/Gemeldet emojis or –) pass through as UTF-8.
• Links column (matched by header name): 0..n whitespace-separated URLs, each rendered as <a target="_blank" rel="noopener"> with a short label (last path segment, e.g. #659). Only http(s) tokens are linkified (defends against javascript: in data); other tokens render as text.
• Graceful fallback: 404 / network error / empty body → a neutral notice ("Aufgabenübersicht wird auf dem Server bereitgestellt (kein Mount in dieser Umgebung)."). Never throws, never leaves the section blank.

Why this keeps CI green

• The change is outside the generator-managed blocks (BEGIN/END:store-listing, BEGIN/END:legal-downloads). Both generators were re-run locally → no diff to those blocks, so the handbook-build-check staleness gates stay green.
• With no CSV mounted (the CI image build), fetch 404s and the renderer shows the fallback — the page loads, the smoke test (/healthz, /de/ auth wall, screenshots) is unaffected.

Verification done locally

• Renderer extracted → node --check clean.
• DOM-shim functional test against the exact Kategorie,Task,Code,Test,Gemeldet,Links schema: comma-in-quoted-field, "" escaping, emoji/– passthrough, single + multiple links with #NNN labels, empty links cell — all pass.
• Fallback paths (404 / network error / empty body) all render the notice.
• HTML parses cleanly; <details>/<script> tags balanced; generated blocks untouched; no internal data in the diff.

Draft until the 3-subagent review loop is clean and handbook-build-check is green (runs on ready-for-review).