Add stage 4: frontend lists view + enforce 100-list cap

API: GET /api/lists is now ordered alphabetically (COLLATE NOCASE) by title
with no other option, and TodoListController rejects a create past 100 lists
per owner with 409. New TodoListRepository::countForOwner.

Frontend: HomeView replaces the placeholder with the user's lists (rendered in
API order) and a create form (title + optional description). New Pinia lists
store fetches and creates, re-fetching after a create so the new list sorts
into place; it is reset on logout. Form disables and explains at 100 lists;
create errors surface inline. Neutral .badge with a .badge--warn variant;
dropped the unused .facts styles.

Tests: alphabetical ordering and the 100-list cap. Suite: 17 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -10,7 +10,8 @@ SQLite file, plus a Vue 3 + TypeScript PWA frontend in [web/](web/).
 | 1 | Auth API — register, login, `GET /me` | ✅ done |
 | 2 | Frontend shell — Vite PWA, auth-gated routing, register/login pages | ✅ done |
 | 3 | Todo list + item CRUD API | ✅ done |
-| 4 | Todo UI in the frontend | planned |
+| 4 | Frontend lists view — list index + create form | ✅ done |
+| 5 | Frontend list detail — items UI | planned |
 
 Registration signs the user in immediately, with the account's email marked
 unverified (`user.email_verified` is `false` until a future stage adds a
@@ -180,12 +181,16 @@ owner (the creator); another user's list — or a missing one — always respond
 
 | Method | Path | Purpose |
 |--------|------|---------|
-| `GET` | `/api/lists` | the caller's lists, newest first |
+| `GET` | `/api/lists` | the caller's lists, sorted A→Z by title |
 | `POST` | `/api/lists` | create a list |
 | `GET` | `/api/lists/{id}` | one list |
 | `PATCH` | `/api/lists/{id}` | update `title` and/or `description` |
 | `DELETE` | `/api/lists/{id}` | delete the list and its items (`204`) |
 
+`GET /api/lists` is always ordered alphabetically (case-insensitive) by title;
+there is no other sort option. A user may own at most **100 lists** — creating
+one beyond that responds `409`.
+
 Create/update body: `title` (required on create, 1–255 chars), `description`
 (optional, ≤ 2000 chars, defaults to `""`). `PATCH` needs at least one field.