feat(lists): drag tasks and list entries onto another list; remember open list and view; live pill in lists

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_lists.go

@@ -245,6 +245,48 @@ func (s *Server) handleDeleteListItem(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
 }
 
+// handleMoveListItem moves an item into another list; the user must be allowed to edit both lists
+func (s *Server) handleMoveListItem(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	itemID := chi.URLParam(r, "itemId")
+	if !s.listItemsWriteAllowed(w, r, itemID) {
+		return
+	}
+	var req struct {
+		TargetListID string `json:"targetListId"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.TargetListID == "" {
+		writeError(w, http.StatusBadRequest, "Zielliste fehlt")
+		return
+	}
+	if req.TargetListID == listID {
+		writeError(w, http.StatusBadRequest, "Eintrag ist bereits in dieser Liste")
+		return
+	}
+	if err := s.store.EnsureListItemsWritable(userID, req.TargetListID, ""); err != nil {
+		if errors.Is(err, storage.ErrListReadOnly) {
+			writeError(w, http.StatusForbidden, err.Error())
+		} else {
+			writeError(w, http.StatusNotFound, err.Error())
+		}
+		return
+	}
+
+	item, err := s.store.MoveListItem(itemID, req.TargetListID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	s.wsHub.BroadcastListEvent(listID, "ITEM_DELETED", map[string]string{
+		"itemId": itemID,
+		"listId": listID,
+	})
+	s.wsHub.BroadcastListEvent(req.TargetListID, "ITEM_CREATED", item)
+	writeJSON(w, http.StatusOK, item)
+}
+
 func (s *Server) handleClearCompletedItems(w http.ResponseWriter, r *http.Request) {
 	listID := chi.URLParam(r, "id")
 	if !s.listItemsWriteAllowed(w, r, "") {