Fix high priority issues from code review

- Default password: Fatal error in production if DEFAULT_PASS not set
- API timeouts: Reduce from 30s to 15s (4 APIs × 15s < 60s global)
- Trello lists: Log warning when list fetch fails instead of silent ignore

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

4 files changed, 10 insertions, 4 deletions

diff --git a/cmd/dashboard/main.go b/cmd/dashboard/main.go
index 74cc836..ef94427 100644
--- a/cmd/dashboard/main.go
+++ b/cmd/dashboard/main.go
@@ -59,6 +59,10 @@ func main() {
 		defaultUser = "admin"
 	}
 	if defaultPass == "" {
+		if !cfg.Debug {
+			log.Fatal("CRITICAL: DEFAULT_PASS must be set in production. Set DEBUG=true for development.")
+		}
+		log.Println("WARNING: Using default password - set DEFAULT_PASS for production")
 		defaultPass = "changeme"
 	}
 	if err := authService.EnsureDefaultUser(defaultUser, defaultPass); err != nil {
diff --git a/internal/api/plantoeat.go b/internal/api/plantoeat.go
index 6fe640d..1dae246 100644
--- a/internal/api/plantoeat.go
+++ b/internal/api/plantoeat.go
@@ -26,7 +26,7 @@ func NewPlanToEatClient(apiKey string) *PlanToEatClient {
 	return &PlanToEatClient{
 		apiKey: apiKey,
 		httpClient: &http.Client{
-			Timeout: 30 * time.Second,
+			Timeout: 15 * time.Second,
 		},
 	}
 }
diff --git a/internal/api/todoist.go b/internal/api/todoist.go
index 14c6c0b..689bf10 100644
--- a/internal/api/todoist.go
+++ b/internal/api/todoist.go
@@ -30,7 +30,7 @@ func NewTodoistClient(apiKey string) *TodoistClient {
 		apiKey:  apiKey,
 		baseURL: todoistBaseURL,
 		httpClient: &http.Client{
-			Timeout: 30 * time.Second,
+			Timeout: 15 * time.Second,
 		},
 	}
 }
diff --git a/internal/api/trello.go b/internal/api/trello.go
index 665bce0..4c4dc95 100644
--- a/internal/api/trello.go
+++ b/internal/api/trello.go
@@ -35,7 +35,7 @@ func NewTrelloClient(apiKey, token string) *TrelloClient {
 		token:   token,
 		baseURL: trelloBaseURL,
 		httpClient: &http.Client{
-			Timeout: 30 * time.Second,
+			Timeout: 15 * time.Second,
 		},
 	}
 }
@@ -142,7 +142,9 @@ func (c *TrelloClient) GetCards(ctx context.Context, boardID string) ([]models.C
 	// Fetch lists to get list names
 	lists, err := c.getLists(ctx, boardID)
 	listMap := make(map[string]string)
-	if err == nil {
+	if err != nil {
+		log.Printf("Warning: failed to fetch lists for board %s, cards will have empty list names: %v", boardID, err)
+	} else {
 		// Build map of list ID to name
 		for _, list := range lists {
 			listMap[list.ID] = list.Name