fix(web): ui fixes

feat: add configurable first day of week

fix(web): renaming column ignored

fix(api): avoid checksum query params in presigned S3 uploads

fix(web): use column.id in task move popover (crash on project select)

fix: apps/api/Dockerfile to reduce vulnerabilities

feat: add mcp

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-UPSTREAM-NODE-14975915
- https://snyk.io/vuln/SNYK-UPSTREAM-NODE-14928492
- https://snyk.io/vuln/SNYK-ALPINE319-MUSL-8720640
- https://snyk.io/vuln/SNYK-ALPINE319-MUSL-8720640
- https://snyk.io/vuln/SNYK-ALPINE319-OPENSSL-7895536

`getStatusLabel` falls back to `toDisplayCase(status)`, which always
returns a non-empty string for any non-empty input. The previous
`getStatusLabel(column.id) || column.name` therefore made `column.name`
unreachable, so users saw a slug-derived label like "Qa Review" instead
of the configured column name like "QA / Review".

Swap the precedence in both the dropdown items and the
`selectedStatusLabel` lookup to show the actual column name first and
only fall back to the i18n status label when the name is empty.

The /tasks API returns project columns as { id: slug, name, isFinal, tasks }
with no `slug` property. TaskMovePopover referenced `column.slug` which was
always undefined, causing every status match to fail silently and ultimately
crashing when the Select rendered items: `getStatusLabel(undefined)` reaches
toDisplayCase, which calls `.replace` on undefined.

Fixes "Cannot read properties of undefined (reading 'replace')" on opening
the task move popover and picking a destination project.

feat(i18n): add Russian and Ukrainian locales

fix: persist project icon from general settings