feat(api): CUST-WP-0018 — API hardening & code quality

T01: Fix datetime.utcnow() → datetime.now(tz=timezone.utc) in MCP server
T02: Wrap _get/_post/_patch/_delete with try/except; return error dicts
T03: Log warnings when write_log skips missing project path
T04: Add priority + due_date_before filters to GET /tasks/
T05: Add owner + slug filters to GET /workstreams/
T06: Add offset param to GET /progress/ for proper pagination
T07: Low-severity bundle:
  - CORS origins from CORS_ORIGINS env var (TD-017)
  - seed.py upsert domains+topics on re-run (TD-011)
  - normalise filter bar CSS → filter-text-input everywhere (TD-016)
  - add 30.5 avg-days-per-month comment in decisions.md (TD-019)
  - TD-009, TD-018 already resolved by existing code

Closes CUST-WP-0018.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routers/progress.py

@@ -20,6 +20,7 @@ async def list_progress(
     event_type: str | None = None,
     since: datetime | None = None,
     limit: int = Query(100, le=1000),
+    offset: int = Query(0, ge=0),
     session: AsyncSession = Depends(get_session),
 ) -> list[ProgressEvent]:
     q = select(ProgressEvent)
@@ -33,7 +34,7 @@ async def list_progress(
         q = q.where(ProgressEvent.event_type == event_type)
     if since:
         q = q.where(ProgressEvent.created_at >= since)
-    q = q.order_by(ProgressEvent.created_at.desc()).limit(limit)
+    q = q.order_by(ProgressEvent.created_at.desc()).offset(offset).limit(limit)
     result = await session.execute(q)
     return list(result.scalars().all())