feat(task): JIRA형 작업 — 설명·우선순위·라벨 필드 + 댓글 스레드

- ProjectTask에 description/priority/labels 추가
- TaskComment 모델 + 엔드포인트(GET/POST /tasks/{id}/comments, DELETE /comments/{id})
- 댓글 작성자=요청자, 삭제는 작성자 또는 관리자
- PATCH /tasks: labels/dependsOn JSON 슬라이스 map 패치 처리

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/httpapi/handlers_projects.go

@@ -1,6 +1,7 @@
 package httpapi
 
 import (
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"strings"
@@ -9,6 +10,7 @@ import (
 	"spin/internal/models"
 
 	"github.com/go-chi/chi/v5"
+	"gorm.io/datatypes"
 )
 
 // ---- company / product / version (master data) ----------------------------
@@ -374,11 +376,78 @@ func (s *Server) handlePatchTask(w http.ResponseWriter, r *http.Request) {
 	}
 	delete(patch, "id")
 	delete(patch, "projectId")
+	// JSON 슬라이스 컬럼(labels/dependsOn)은 map 패치 시 driver.Valuer로 변환해 줘야 한다.
+	for _, k := range []string{"labels", "dependsOn"} {
+		if v, ok := patch[k]; ok {
+			if b, err := json.Marshal(v); err == nil {
+				patch[k] = datatypes.JSON(b)
+			}
+		}
+	}
 	s.db.Model(&t).Updates(patch)
 	s.db.First(&t, "id = ?", t.ID)
 	writeJSON(w, http.StatusOK, t)
 }
 
+// ---- task comments (JIRA형 댓글) -----------------------------------------
+
+func (s *Server) taskProjectID(taskID string) (string, bool) {
+	var t models.ProjectTask
+	if err := s.db.Select("project_id").First(&t, "id = ?", taskID).Error; err != nil {
+		return "", false
+	}
+	return t.ProjectID, true
+}
+
+func (s *Server) handleListTaskComments(w http.ResponseWriter, r *http.Request) {
+	tid := chi.URLParam(r, "tId")
+	pid, ok := s.taskProjectID(tid)
+	if !ok || !s.canSeeProject(r, pid) {
+		writeError(w, http.StatusForbidden, "권한이 없습니다")
+		return
+	}
+	var out []models.TaskComment
+	s.db.Where("task_id = ?", tid).Order("created_at asc").Find(&out)
+	writeJSON(w, http.StatusOK, out)
+}
+
+func (s *Server) handleCreateTaskComment(w http.ResponseWriter, r *http.Request) {
+	tid := chi.URLParam(r, "tId")
+	pid, ok := s.taskProjectID(tid)
+	if !ok || !s.canSeeProject(r, pid) {
+		writeError(w, http.StatusForbidden, "권한이 없습니다")
+		return
+	}
+	var c models.TaskComment
+	if err := decodeJSON(r, &c); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	if strings.TrimSpace(c.Body) == "" {
+		writeError(w, http.StatusBadRequest, "내용을 입력하세요")
+		return
+	}
+	c.ID = ""
+	c.TaskID = tid
+	c.AuthorEmail = s.email(r)
+	s.db.Create(&c)
+	writeJSON(w, http.StatusCreated, c)
+}
+
+func (s *Server) handleDeleteTaskComment(w http.ResponseWriter, r *http.Request) {
+	var c models.TaskComment
+	if err := s.db.First(&c, "id = ?", chi.URLParam(r, "cId")).Error; err != nil {
+		writeError(w, http.StatusNotFound, "댓글을 찾을 수 없습니다")
+		return
+	}
+	if !s.isAdmin(r) && !s.owns(r, c.AuthorEmail) {
+		writeError(w, http.StatusForbidden, "본인 댓글만 삭제할 수 있습니다")
+		return
+	}
+	s.db.Delete(&models.TaskComment{}, "id = ?", c.ID)
+	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
+}
+
 func (s *Server) handleDeleteTask(w http.ResponseWriter, r *http.Request) {
 	var t models.ProjectTask
 	if err := s.db.First(&t, "id = ?", chi.URLParam(r, "tId")).Error; err != nil {

internal/httpapi/router.go

@@ -123,6 +123,9 @@ func NewRouter(db *gorm.DB, store *storage.Storage, cfg config.Config, pusher *p
 			r.Post("/projects/{id}/tasks", s.handleCreateTask)
 			r.Patch("/tasks/{tId}", s.handlePatchTask)
 			r.Delete("/tasks/{tId}", s.handleDeleteTask)
+			r.Get("/tasks/{tId}/comments", s.handleListTaskComments)
+			r.Post("/tasks/{tId}/comments", s.handleCreateTaskComment)
+			r.Delete("/comments/{cId}", s.handleDeleteTaskComment)
 			// admin-only commercial block
 			r.Get("/projects/{id}/contract", s.handleGetContract)
 			r.Put("/projects/{id}/contract", s.handlePutContract)