feat: list + task endpoints and CORS, verified end-to-end

server/api/lists.put.ts

@@ -0,0 +1,15 @@
+// PUT /api/lists (desktop) — full-replace catalog. Upsert all supplied; delete the rest.
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  if (
+    !Array.isArray(body) ||
+    body.some((l) => typeof l?.id !== "string" || typeof l?.name !== "string")
+  ) {
+    throw createError({ statusCode: 400, statusMessage: "expected [{ id, name }]" });
+  }
+  await replaceLists(
+    getSql(),
+    body.map((l) => ({ id: l.id, name: l.name })),
+  );
+  return { ok: true };
+});