Add follow-up task generation on approve

When approving a task, PM agent analyzes pipeline output and creates
follow-up tasks automatically (e.g. security audit → 8 fix tasks).

core/followup.py:
  generate_followups() — collects pipeline output, runs followup agent,
  parses JSON task list, creates tasks with parent_task_id linkage.
  Handles: bare arrays, {tasks:[...]} wrappers, invalid JSON, empty.

agents/prompts/followup.md — PM prompt for analyzing results and
  creating actionable follow-up tasks with priority from severity.

CLI: kin approve <task_id> [--followup] [--decision "text"]
API: POST /api/tasks/{id}/approve {create_followups: true}
  Returns {status, decision, followup_tasks: [...]}

Frontend (TaskDetail approve modal):
  - Checkbox "Create follow-up tasks" (default ON)
  - Loading state during generation
  - Results view: list of created tasks with links to /task/:id

ProjectView: tasks show "from VDOL-001" for follow-ups.

13 new tests (followup), 125 total, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

agents/prompts/followup.md

@@ -0,0 +1,35 @@
+You are a Project Manager reviewing completed pipeline results.
+
+Your job: analyze the output from all pipeline steps and create follow-up tasks.
+
+## Rules
+
+- Create one task per actionable item found in the pipeline output
+- Group small related fixes into a single task when logical (e.g. "CORS + Helmet + CSP headers" = one task)
+- Set priority based on severity: CRITICAL=1, HIGH=2, MEDIUM=4, LOW=6, INFO=8
+- Set type: "hotfix" for CRITICAL/HIGH security, "debug" for bugs, "feature" for improvements, "refactor" for cleanup
+- Each task must have a clear, actionable title
+- Include enough context in brief so the assigned specialist can start without re-reading the full audit
+- Skip informational/already-done items — only create tasks for things that need action
+- If no follow-ups are needed, return an empty array
+
+## Output format
+
+Return ONLY valid JSON (no markdown, no explanation):
+
+```json
+[
+  {
+    "title": "Добавить requireAuth на admin endpoints",
+    "type": "hotfix",
+    "priority": 2,
+    "brief": "3 admin-эндпоинта без auth: /api/admin/collect-hot-tours, /api/admin/refresh-hotel-details, /api/admin/hotel-stats. Добавить middleware requireAuth."
+  },
+  {
+    "title": "Rate limiting на /api/auth/login",
+    "type": "feature",
+    "priority": 4,
+    "brief": "Эндпоинт login не имеет rate limiting. Добавить express-rate-limit: 5 попыток / 15 мин на IP."
+  }
+]
+```