feat: scope every API endpoint to the token's sub; expose ownerId in DTOs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/api/tasks/[id]/consume.post.ts

@@ -1,6 +1,6 @@
-// POST /api/tasks/:id/consume (desktop) — mark a web task imported. Idempotent.
+// POST /api/tasks/:id/consume (desktop) — mark the caller's web task imported. Idempotent.
 export default defineEventHandler(async (event) => {
-  const ok = await consume(getSql(), getRouterParam(event, "id")!);
+  const ok = await consume(getSql(), ownerOf(event), getRouterParam(event, "id")!);
   if (!ok) {
     throw createError({ statusCode: 404, statusMessage: "task not found" });
   }