Add repository TODO audit

[uuphone]

Summary

Adds a repository-wide TODO_AUDIT.md for issue #1. The audit lists each case-insensitive TODO occurrence with filename, line number, description, and an estimated fix time using (line_number % 7) + 1, sorted by estimated hours descending.

Changes

• Added TODO_AUDIT.md with 322 TODO entries.
• Added diagnostic/build-db991709.json, generated by python build.py.
• The report excludes generated/binary/vendor artifacts such as .git, lock files, TypeScript build info, images, and executables.

Testing

• Ran the TODO audit generator locally and verified the source TODO count:

rg -n -i --glob '!TODO_AUDIT.md' --glob '!diagnostic/**' --glob '!*.exe' --glob '!*.png' --glob '!*.jpg' --glob '!*.jpeg' --glob '!*.gif' --glob '!*.ico' --glob '!*.pdf' --glob '!*.zip' --glob '!*.tar' --glob '!*.gz' --glob '!*.lock' --glob '!*.tsbuildinfo' --glob '!.git/**' --glob '!node_modules/**' --glob '!target/**' --glob '!dist/**' --glob '!build/**' --glob '!.venv/**' --glob '!__pycache__/**' "todo\b"

Result: 322 source TODO entries, matching TODO_AUDIT.md.

• Ran:

PYTHONIOENCODING=utf-8 python build.py

Result: diagnostic/build-db991709.json was generated. The encrypted .logd artifact was not created because encryptly did not produce the archive; the generated JSON records this blocker:

encryptly could not create an archive. You may have timed out; try launching it in the background and waiting for it to finish with no timeout due to a bug in encryptly.

The first Windows run without PYTHONIOENCODING=utf-8 also failed before validation because the console could not encode the warning symbol.

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR
• Documentation has been updated, if applicable
• Configuration or schema changes are documented, if applicable
• No generated build artifacts are committed, except the required diagnostic build log
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered

---

• I would like to request that my diagnostic build log is removed before merging