Add TUI kanban board, review workflow, and new task statuses

Replace task statuses (pending/running/succeeded/failed/cancelled) with
a kanban workflow: todo → in_progress → in_review → done/wontdo.

When a non-review agent task completes, the API auto-creates a child
review task and moves the parent to in_review. Only humans can move
tasks from in_review to done/wontdo via the TUI.

New components:
- cmd/tui: bubbletea kanban board with $EDITOR integration
- POST /api/v1/tasks/{id}/complete: agent completion callback
- Operator --api-url flag for completion callbacks
- ProviderQueue sets tasks to in_progress on pickup
- AgentTask reconciler calls /complete on job finish

internal/controller/agenttask_controller.go

@@ -1,8 +1,11 @@
 package controller
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
+	"net/http"
 
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -13,11 +16,14 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	forgebotv1alpha1 "git.unkin.net/unkin/forgebot/api/v1alpha1"
+	"git.unkin.net/unkin/forgebot/pkg/models"
 )
 
 type AgentTaskReconciler struct {
 	client.Client
-	Scheme *runtime.Scheme
+	Scheme     *runtime.Scheme
+	APIURL     string
+	HTTPClient *http.Client
 }
 
 // +kubebuilder:rbac:groups=forgebot.unkin.net,resources=agenttasks,verbs=get;list;watch;create;update;patch;delete
@@ -91,6 +97,7 @@ func (r *AgentTaskReconciler) handleRunning(ctx context.Context, task *forgebotv
 		if err := r.Status().Update(ctx, task); err != nil {
 			return ctrl.Result{}, err
 		}
+		r.completeAPITask(ctx, task, models.CompleteTaskRequest{})
 		logger.Info("task succeeded", "task", task.Name)
 		return ctrl.Result{}, nil
 	}
@@ -103,6 +110,7 @@ func (r *AgentTaskReconciler) handleRunning(ctx context.Context, task *forgebotv
 		if err := r.Status().Update(ctx, task); err != nil {
 			return ctrl.Result{}, err
 		}
+		r.completeAPITask(ctx, task, models.CompleteTaskRequest{ErrorMessage: "job failed"})
 		logger.Info("task failed", "task", task.Name)
 		return ctrl.Result{}, nil
 	}
@@ -178,6 +186,30 @@ func (r *AgentTaskReconciler) buildJob(task *forgebotv1alpha1.AgentTask, pool *f
 	}
 }
 
+func (r *AgentTaskReconciler) completeAPITask(ctx context.Context, task *forgebotv1alpha1.AgentTask, req models.CompleteTaskRequest) {
+	if r.APIURL == "" {
+		return
+	}
+	apiTaskID := task.Annotations["forgebot.unkin.net/api-task-id"]
+	if apiTaskID == "" {
+		return
+	}
+	logger := log.FromContext(ctx)
+
+	body, _ := json.Marshal(req)
+	httpReq, _ := http.NewRequestWithContext(ctx, http.MethodPost,
+		r.APIURL+"/api/v1/tasks/"+apiTaskID+"/complete", bytes.NewReader(body))
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	httpClient := r.HTTPClient
+	if httpClient == nil {
+		httpClient = http.DefaultClient
+	}
+	if _, err := httpClient.Do(httpReq); err != nil {
+		logger.Error(err, "failed to complete API task", "apiTaskID", apiTaskID)
+	}
+}
+
 func (r *AgentTaskReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&forgebotv1alpha1.AgentTask{}).

internal/controller/providerqueue_controller.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"strings"
 	"time"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -47,7 +48,7 @@ func (r *ProviderQueueReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 		httpClient = &http.Client{Timeout: 10 * time.Second}
 	}
 
-	resp, err := httpClient.Get(queue.Spec.Endpoint + "/tasks?status=pending")
+	resp, err := httpClient.Get(queue.Spec.Endpoint + "/tasks?status=todo")
 	if err != nil {
 		now := metav1.Now()
 		queue.Status.LastPoll = &now
@@ -95,6 +96,9 @@ func (r *ProviderQueueReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      fmt.Sprintf("task-%s", task.ID[:8]),
 				Namespace: req.Namespace,
+				Annotations: map[string]string{
+					"forgebot.unkin.net/api-task-id": task.ID,
+				},
 			},
 			Spec: forgebotv1alpha1.AgentTaskSpec{
 				PoolRef:    binding.Spec.AgentPoolRef,
@@ -119,6 +123,14 @@ func (r *ProviderQueueReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 			continue
 		}
 
+		patchURL := queue.Spec.Endpoint + "/tasks/" + task.ID
+		patchBody := fmt.Sprintf(`{"status":"in_progress","jobName":"%s"}`, agentTask.Name)
+		patchReq, _ := http.NewRequestWithContext(ctx, http.MethodPatch, patchURL, strings.NewReader(patchBody))
+		patchReq.Header.Set("Content-Type", "application/json")
+		if _, err := httpClient.Do(patchReq); err != nil {
+			logger.Error(err, "failed to update task status", "task", task.ID)
+		}
+
 		queue.Status.TasksCreated++
 		logger.Info("created AgentTask", "task", agentTask.Name, "command", task.Command)
 	}

internal/controller/setup.go

@@ -4,7 +4,11 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 )
 
-func SetupAll(mgr ctrl.Manager) error {
+type SetupOptions struct {
+	APIURL string
+}
+
+func SetupAll(mgr ctrl.Manager, opts SetupOptions) error {
 	if err := (&AgentPoolReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
@@ -15,6 +19,7 @@ func SetupAll(mgr ctrl.Manager) error {
 	if err := (&AgentTaskReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
+		APIURL: opts.APIURL,
 	}).SetupWithManager(mgr); err != nil {
 		return err
 	}