Add backlog audit and task update command

- agents/prompts/backlog_audit.md: QA analyst prompt for checking
  which pending tasks are already implemented in the codebase
- agents/runner.py: run_audit() — project-level agent that reads
  all pending tasks, inspects code, returns classification
- cli/main.py: kin audit <project_id> — runs audit, offers to mark
  done tasks; kin task update <id> --status --priority
- web/api.py: POST /api/projects/{id}/audit (runs audit inline),
  POST /api/projects/{id}/audit/apply (batch mark as done)
- Frontend: "Audit backlog" button on ProjectView with results
  modal showing already_done/still_pending/unclear categories

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_api.py

@@ -201,3 +201,35 @@ def test_project_summary_includes_review(client):
     r = client.get("/api/projects")
     projects = r.json()
     assert projects[0]["review_tasks"] == 1
+
+
+def test_audit_not_found(client):
+    r = client.post("/api/projects/NOPE/audit")
+    assert r.status_code == 404
+
+
+def test_audit_apply(client):
+    """POST /audit/apply should mark tasks as done."""
+    r = client.post("/api/projects/p1/audit/apply",
+                    json={"task_ids": ["P1-001"]})
+    assert r.status_code == 200
+    assert r.json()["count"] == 1
+    assert "P1-001" in r.json()["updated"]
+
+    # Verify task is done
+    r = client.get("/api/tasks/P1-001")
+    assert r.json()["status"] == "done"
+
+
+def test_audit_apply_not_found(client):
+    r = client.post("/api/projects/NOPE/audit/apply",
+                    json={"task_ids": ["P1-001"]})
+    assert r.status_code == 404
+
+
+def test_audit_apply_wrong_project(client):
+    """Tasks not belonging to the project should be skipped."""
+    r = client.post("/api/projects/p1/audit/apply",
+                    json={"task_ids": ["WRONG-001"]})
+    assert r.status_code == 200
+    assert r.json()["count"] == 0