fix: add PUT /tasks/mirror (array full-replace of desktop Idle backlog)

The desktop pushes its full Idle backlog as a JSON array to /tasks/mirror, not per-task.
Previously /tasks/mirror matched tasks/[id].put.ts (id=mirror) and rejected the array with
400. New static route validates per-element, accepts empty arrays, upserts each as
consumed=true (desktop-owned), deletes consumed=true rows not in the array, and leaves
web-created consumed=false rows untouched. Mirrors PUT /lists.

server/api/tasks/mirror.put.ts

@@ -0,0 +1,43 @@
+// PUT /api/tasks/mirror (desktop) — full-replace of the desktop's current Idle backlog.
+// Body: [{ id, listId, title, description? }, ...] (camelCase). An empty array is valid and
+// clears the desktop-owned partition. Mirrors PUT /lists. Web-created tasks awaiting pull
+// (consumed=false) are never touched here.
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  if (!Array.isArray(body)) {
+    throw createError({ statusCode: 400, statusMessage: "expected an array of tasks" });
+  }
+
+  const items: { id: string; listId: string; title: string; description: string | null }[] = [];
+  for (let i = 0; i < body.length; i++) {
+    const t = body[i];
+    if (typeof t?.id !== "string" || !t.id.trim()) {
+      throw createError({ statusCode: 400, statusMessage: `item ${i}: id is required` });
+    }
+    if (typeof t?.listId !== "string" || !t.listId.trim()) {
+      throw createError({ statusCode: 400, statusMessage: `item ${i}: listId is required` });
+    }
+    if (typeof t?.title !== "string" || !t.title.trim()) {
+      throw createError({ statusCode: 400, statusMessage: `item ${i}: title is required` });
+    }
+    items.push({
+      id: t.id,
+      listId: t.listId,
+      title: t.title,
+      description: typeof t.description === "string" ? t.description : null,
+    });
+  }
+
+  const sql = getSql();
+
+  // Every referenced list must exist (lists are full-replaced before tasks are mirrored).
+  const listIds = [...new Set(items.map((t) => t.listId))];
+  for (const id of listIds) {
+    if (!(await listExists(sql, id))) {
+      throw createError({ statusCode: 400, statusMessage: `unknown listId: ${id}` });
+    }
+  }
+
+  await mirrorDesktopTasks(sql, items);
+  return { ok: true, count: items.length };
+});

server/utils/repo.ts

@@ -83,6 +83,38 @@ export async function upsertDesktopTask(
   return { created: row.created };
 }
 
+/**
+ * Full-replace of the desktop-owned partition (the desktop's current Idle backlog).
+ * Mirrors `replaceLists`: upsert every supplied task as desktop-owned (consumed=true), and
+ * delete any desktop-owned (consumed=true) task not in the payload. Web-created tasks still
+ * awaiting pull (consumed=false) are left untouched. An empty array clears the partition.
+ */
+export async function mirrorDesktopTasks(
+  sql: Sql,
+  items: { id: string; listId: string; title: string; description?: string | null }[],
+): Promise<void> {
+  await sql.begin(async (tx) => {
+    for (const t of items) {
+      await tx`
+        insert into tasks (id, list_id, title, description, source, consumed)
+        values (${t.id}, ${t.listId}, ${t.title}, ${t.description ?? null}, 'desktop', true)
+        on conflict (id) do update set
+          list_id = excluded.list_id,
+          title = excluded.title,
+          description = excluded.description,
+          source = 'desktop',
+          consumed = true,
+          updated_at = now()`;
+    }
+    const ids = items.map((t) => t.id);
+    if (ids.length) {
+      await tx`delete from tasks where consumed = true and id <> all(${ids})`;
+    } else {
+      await tx`delete from tasks where consumed = true`;
+    }
+  });
+}
+
 /** Web-created tasks the desktop has not yet imported. */
 export async function getUnconsumed(sql: Sql): Promise<TaskRow[]> {
   return sql<TaskRow[]>`