feat: list + task endpoints and CORS, verified end-to-end

server/api/tasks.get.ts

@@ -0,0 +1,11 @@
+// GET /api/tasks?consumed=false (desktop) — web-created tasks not yet imported.
+export default defineEventHandler(async () => {
+  const rows = await getUnconsumed(getSql());
+  return rows.map((r) => ({
+    id: r.id,
+    listId: r.list_id,
+    title: r.title,
+    description: r.description,
+    createdAt: new Date(r.created_at).toISOString(),
+  }));
+});