fix(security): list items need write access to their list (FLAW-27)

Creating, checking, editing, deleting, reordering and clearing list
items did not check the list at all: any logged-in user with a list or
item ID could change it, viewers of shared lists as well. All item
endpoints and converting a thought into a list item now require owner
or editor rights and that the item belongs to the list (404 without
access, 403 for viewers).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/thoughts.go

@@ -375,6 +375,10 @@ func (s *Store) UpdateThoughtTriage(userID, thoughtID, action, convertTo, target
 				convertedRefID = doc.ID
 			}
 		} else if convertTo == "list_item" && targetListID != "" {
+			// Same rule as adding an item in the list itself: owner or editor
+			if err := s.EnsureListItemsWritable(userID, targetListID, ""); err != nil {
+				return nil, err
+			}
 			newStatus = domain.StatusConverted
 			convertedType = "list_item"
 			item, err := s.CreateListItem(targetListID, thought.Content, "", "", 0, userID)