Add stage 3: todo list and item CRUD API

Two migrations add todo_lists (owner_id FK to users, title, description) and
todo_items (list_id FK, text, complete, position), both with ON DELETE
CASCADE.

New endpoints under /api/lists, all behind AuthMiddleware:
  - lists: index / store / show / update (PATCH) / destroy
  - items: nested under a list, same five verbs
Lists are owner-scoped — another user's or a missing list responds 404, never
403. New items append after the highest position unless one is given; the
list carries item_count / completed_count. Item PATCH is partial and never
renumbers siblings.

Adds App\Support\Validator for request-body checks, TodoList/TodoItem
repositories, and body()/user() helpers on the Controller base. Feature tests
move their shared harness into tests/ApiTestCase; TodoTest covers CRUD,
ownership isolation, ordering, completion counts, validation and cascade
delete. Full suite: 15 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Http/Controllers/Controller.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Http\Controllers;
 
 use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
 
 /**
  * Shared helpers for HTTP controllers.
@@ -26,4 +27,29 @@ abstract class Controller
             ->withHeader('Content-Type', 'application/json')
             ->withStatus($status);
     }
+
+    /**
+     * The parsed JSON request body as an array (empty when absent or not an object).
+     *
+     * @return array<string, mixed>
+     */
+    protected function body(Request $request): array
+    {
+        $parsed = $request->getParsedBody();
+
+        return is_array($parsed) ? $parsed : [];
+    }
+
+    /**
+     * The authenticated user attached by AuthMiddleware.
+     *
+     * @return array{id: int, email: string, email_verified_at: string|null, created_at: string}
+     */
+    protected function user(Request $request): array
+    {
+        /** @var array{id: int, email: string, email_verified_at: string|null, created_at: string} $user */
+        $user = $request->getAttribute('user');
+
+        return $user;
+    }
 }