Skips Keycloak SSO entirely when APP_DEBUG=true, treating every request
as an authenticated dev-admin user. Must stay false in any deployed
environment (see .env_prod).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Track when a card moves between columns/swim lanes: who moved it, when,
and where from/to. Logged on every column/lane change via CardsController::move(),
surfaced in the card modal via GET /cards/{id}/history.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

the board create and edit forms. The import script already parses newline-separated
tokens; only the UI was blocking multi-filter entry. No backend changes required.