feat: scope every API endpoint to the token's sub; expose ownerId in DTOs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/api/tasks.get.ts

@@ -1,11 +1,12 @@
-// GET /api/tasks?consumed=false (desktop) — web-created tasks not yet imported.
-export default defineEventHandler(async () => {
-  const rows = await getUnconsumed(getSql());
+// GET /api/tasks?consumed=false (desktop) — the caller's web-created tasks not yet imported.
+export default defineEventHandler(async (event) => {
+  const rows = await getUnconsumed(getSql(), ownerOf(event));
   return rows.map((r) => ({
     id: r.id,
     listId: r.list_id,
     title: r.title,
     description: r.description,
+    ownerId: r.owner_id,
     createdAt: new Date(r.created_at).toISOString(),
   }));
 });