Add stage 5: list detail page with items UI and drag reorder

API: new PUT /api/lists/{id}/items/order takes the full ordered id set and
rewrites positions 0..n-1 in a transaction (422 unless the set matches the
list exactly). TodoItemRepository gains idsForList() and reorder().

Frontend: lists on the home page are now links to /lists/:id (ListView).
ListView shows the list title, a "M of N done" summary, and each item as a
drag handle + checkbox + inline-editable text (saved on blur) + delete
button, with a create-item form at the bottom. Drag-and-drop uses
vuedraggable; on drop the whole order is persisted via the new endpoint and
the response replaces local state, with a resync-on-error fallback. New
items store; items store is also reset on logout.

Tests: reorder happy path, incomplete-set rejection, owner scoping. Backend
suite: 23 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/components/TodoItemRow.vue

@@ -0,0 +1,56 @@
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import type { TodoItem } from '../types'
+
+const props = defineProps<{ item: TodoItem }>()
+const emit = defineEmits<{
+  toggle: [complete: boolean]
+  'save-text': [text: string]
+  delete: []
+}>()
+
+const text = ref(props.item.text)
+watch(
+  () => props.item.text,
+  (value) => {
+    text.value = value
+  },
+)
+
+function commit() {
+  const next = text.value.trim()
+  if (next === '') {
+    text.value = props.item.text // the API requires a non-empty text
+    return
+  }
+  if (next !== props.item.text) emit('save-text', next)
+}
+</script>
+
+<template>
+  <li class="item" :class="{ 'item--done': item.complete }">
+    <span class="item__handle" aria-hidden="true" title="Drag to reorder">⠿</span>
+
+    <input
+      class="item__check"
+      type="checkbox"
+      :checked="item.complete"
+      :aria-label="item.complete ? 'Mark as not done' : 'Mark as done'"
+      @change="emit('toggle', ($event.target as HTMLInputElement).checked)"
+    />
+
+    <input
+      v-model="text"
+      class="item__text"
+      type="text"
+      maxlength="1000"
+      aria-label="Item text"
+      @blur="commit"
+      @keyup.enter="($event.target as HTMLInputElement).blur()"
+    />
+
+    <button type="button" class="item__delete" aria-label="Delete item" @click="emit('delete')">
+      ✕
+    </button>
+  </li>
+</template>