Add a bounded dashboard attention projection

[FZ2000]

Effect in one sentence

Adds an authenticated, bounded /v1/attention projection that classifies all visible Tasks before limiting rows, giving clients a truthful complete review count without fetching every Receipt.

Stack position

1 of 6: #153 (this API) → #155 → #157 → #159 → #160 → #161.

This stack is an alternative to standalone #152.

Endpoint contract

GET /v1/attention?limit=5

• Advertised as agentacct.v1-attention.v1 and protected by the existing local bearer token.
• Returns complete counts for failed checks, failed steps, and blockers plus only 1–50 compact rows.
• Failed checks/steps lead blockers; recency and opaque Task ID provide stable tie-breaks.
• A Task with several reasons appears once under its leading reason.
• Settled findings are excluded; an unresolved failure cannot be hidden by a newer resolved sibling.
• Missing remediation stays missing; the endpoint never invents a next step.
• Classification reuses the cached Task projection and builds compact rows only after sort/limit.

Review order

1. src/agentacct/receipt.py — leading-reason selection.
2. src/agentacct/api.py — route, schema, auth, bounds, counts, and cache.
3. Receipt reducer/API tests.
4. Public task-control-plane documentation.

Verification at current head 06caf21

• Current-head GitHub CI passes pytest on Python 3.11/3.12/3.13 and the macOS app/snapshot job.
• Focused receipt/reducer API tests — 43 passed.
• python -m compileall -q src tests — passed.
• Full local Python suite — 2,639 passed; the 9 macOS process-identity failures reproduce on pristine origin/main, while Linux CI is green.
• git diff --check origin/main...HEAD — clean.

Scope

This is the data-contract foundation only. It does not change the Swift Dashboard or mutate Tasks, findings, blockers, providers, or agents.