feat(templates/projects/partials): replace hard-coded status completion check with configurable allowed_move_to_status_ids

Prevents brute-force attacks by only allowing moves to statuses explicitly permitted.

templates/projects/partials/board_columns.html

@@ -25,8 +25,8 @@
          @drop.prevent="
             $el.classList.remove('ring-2', 'ring-blue-500');
             if (!dragging) return;
-            {% if not user_can_move_to_completed %}
-            if ($el.dataset.statusCompleted === 'true') return;
+            {% if allowed_move_to_status_ids is not None %}
+            if (![{{ allowed_move_to_status_ids|join:"," }}].includes(parseInt($el.dataset.statusId))) return;
             {% endif %}
             const tid = dragging;
             dragging = null;