feat(defects): file a defect via a board-section modal (T5)

POST /api/defects validates the body with arktype (known section, uuid
project, non-empty trimmed verbatim) and resolves the reporter through a dev
seam (getReporter, ADR 0002) until OAuth lands. DefectForm is a DaisyUI modal
opened by a section click — pick a project, describe the problem, submit.

server/utils/getReporter.ts

@@ -0,0 +1,10 @@
+import type { H3Event } from 'h3'
+
+/**
+ * Resolves the reporter's email — the one seam between filing and auth (ADR
+ * 0002). For now it returns a fixed dev identity so the filing slice works
+ * before OAuth exists; Task 9 swaps this to read the verified session email.
+ */
+export function getReporter(_event: H3Event): string {
+  return process.env.DEV_REPORTER_EMAIL ?? 'dev@theodo.com'
+}