feat: scope every API endpoint to the token's sub; expose ownerId in DTOs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/api/tasks/[id].delete.ts

@@ -1,6 +1,6 @@
-// DELETE /api/tasks/:id (desktop) — task left Idle on desktop. Idempotent.
+// DELETE /api/tasks/:id (desktop) — task left Idle on desktop. Idempotent, scoped to the caller's rows.
 export default defineEventHandler(async (event) => {
-  await deleteTask(getSql(), getRouterParam(event, "id")!);
+  await deleteTask(getSql(), ownerOf(event), getRouterParam(event, "id")!);
   setResponseStatus(event, 204);
   return null;
 });