feat(api): tasks routes

Add lib/api/routes/tasks.js: list by space (status filter), list by
project (position then created_at), create scoped to space with
optional project_id, get/patch/delete by id. status=done flips
completed_at via the repo's existing trigger logic.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/api/routes/tasks.js

@@ -0,0 +1,92 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import * as repo from '../../db/repos/tasks.js';
+import { validate } from '../validate.js';
+import { NotFoundError, ValidationError, asyncWrap } from '../errors.js';
+
+const STATUSES = ['todo', 'doing', 'blocked', 'done'];
+
+const createSchema = z.object({
+  project_id: z.string().uuid().nullable().optional(),
+  title: z.string().min(1).max(500),
+  body: z.string().optional(),
+  priority: z.number().int().optional(),
+  due_at: z.string().datetime().nullable().optional(),
+  position: z.number().int().optional()
+});
+
+const patchSchema = z.object({
+  project_id: z.string().uuid().nullable().optional(),
+  title: z.string().min(1).max(500).optional(),
+  body: z.string().nullable().optional(),
+  status: z.enum(STATUSES).optional(),
+  priority: z.number().int().nullable().optional(),
+  due_at: z.string().datetime().nullable().optional(),
+  position: z.number().int().nullable().optional()
+});
+
+const idParams = z.object({ id: z.string().uuid() });
+const spaceParams = z.object({ space_id: z.string().uuid() });
+const projectParams = z.object({ project_id: z.string().uuid() });
+
+export const router = Router();
+export const spacesScopedRouter = Router({ mergeParams: true });
+export const projectsScopedRouter = Router({ mergeParams: true });
+
+spacesScopedRouter.get('/',
+  validate({ params: spaceParams, query: z.object({ status: z.enum(STATUSES).optional() }) }),
+  asyncWrap(async (req, res) => {
+    res.json(await repo.listBySpace(req.params.space_id, { status: req.validatedQuery.status }));
+  })
+);
+
+spacesScopedRouter.post('/',
+  validate({ params: spaceParams, body: createSchema }),
+  asyncWrap(async (req, res) => {
+    try {
+      const row = await repo.create({ ...req.body, space_id: req.params.space_id }, req.actor);
+      res.status(201).json(row);
+    } catch (e) {
+      if (e.code === '23503') throw new ValidationError('invalid space or project', {
+        space_id: req.params.space_id, project_id: req.body.project_id
+      });
+      throw e;
+    }
+  })
+);
+
+projectsScopedRouter.get('/',
+  validate({ params: projectParams }),
+  asyncWrap(async (req, res) => {
+    res.json(await repo.listByProject(req.params.project_id));
+  })
+);
+
+router.get('/:id',
+  validate({ params: idParams }),
+  asyncWrap(async (req, res) => {
+    const row = await repo.getById(req.params.id);
+    if (!row) throw new NotFoundError('task not found');
+    res.json(row);
+  })
+);
+
+router.patch('/:id',
+  validate({ params: idParams, body: patchSchema }),
+  asyncWrap(async (req, res) => {
+    const existing = await repo.getById(req.params.id);
+    if (!existing) throw new NotFoundError('task not found');
+    const row = await repo.update(req.params.id, req.body, req.actor);
+    res.json(row);
+  })
+);
+
+router.delete('/:id',
+  validate({ params: idParams }),
+  asyncWrap(async (req, res) => {
+    const existing = await repo.getById(req.params.id);
+    if (!existing) throw new NotFoundError('task not found');
+    await repo.del(req.params.id, req.actor);
+    res.status(204).end();
+  })
+);