feat: scope every API endpoint to the token's sub; expose ownerId in DTOs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/api/lists.get.ts

@@ -1,4 +1,5 @@
-// GET /api/lists (web) — all lists.
-export default defineEventHandler(async () => {
-  return getLists(getSql());
+// GET /api/lists (web) — the caller's lists (plus legacy unowned).
+export default defineEventHandler(async (event) => {
+  const rows = await getLists(getSql(), ownerOf(event));
+  return rows.map((r) => ({ id: r.id, name: r.name, ownerId: r.owner_id }));
 });