fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

Store.execInTx runs related statements in one transaction and returns
the first error. Used for deleting and moving folders (with the trash),
shared folders, folder shares and mounts, deleting task lists and
accounts, pinning, and the password reset (new password and the end of
all other links together). Writes whose success the API reports now
pass their error to the client (logout, new password, setup, sharing
mode, new group, restore, unlinking a note block), follow-up tasks and
alarm markers log failures. Remaining ignored writes are listed as
intentional in flaws.md.

Found on the way: DeleteTaskList unlinked all tasks before checking
ownership, so a stranger with the list ID could empty it; viewers could
unlink tasks from note blocks. Both fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/tasklists.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"strings"
 
 	"github.com/sandrodach/mindsift/internal/domain"
@@ -52,7 +53,9 @@ func (s *Store) CreateTaskList(userID, spaceID, teamID, title, icon, color strin
 		return nil, err
 	}
 	if teamID != "" && s.CanShareWith(userID, "team", teamID) {
-		_, _ = s.AddTaskListShare(tl.ID, "team", teamID, "editor", userID)
+		if _, err := s.AddTaskListShare(tl.ID, "team", teamID, "editor", userID); err != nil {
+			return nil, err
+		}
 	}
 	return s.GetTaskListByID(userID, tl.ID)
 }
@@ -323,7 +326,7 @@ func (s *Store) SetTaskAssignees(userID, taskID string, assignees []string) ([]s
 // left the team, team deleted, task moved to another list or out of any list). Called after each change
 // that can take access away, so assignments never outlive permissions.
 func (s *Store) PruneTaskAssignees() {
-	_, _ = s.db.Exec(
+	_, err := s.db.Exec(
 		`DELETE FROM task_assignees WHERE rowid IN (
 		    SELECT ta.rowid FROM task_assignees ta
 		    LEFT JOIN thoughts t ON t.id = ta.task_id
@@ -331,6 +334,9 @@ func (s *Store) PruneTaskAssignees() {
 		       OR ta.user_id NOT IN (` + fmt.Sprintf(taskListAccessSQL, "t.task_list_id") + `)
 		 )`,
 	)
+	if err != nil {
+		slog.Error("Zuweisungen bereinigen fehlgeschlagen", "error", err)
+	}
 }
 
 // GetTaskListUserIDs returns every user who can see the task list: owner, direct shares and members of shared teams.
@@ -533,9 +539,18 @@ func (s *Store) UpdateTaskList(userID, listID string, title, icon, color, spaceI
 }
 
 func (s *Store) DeleteTaskList(userID, listID string) error {
-	_, _ = s.db.Exec(`UPDATE thoughts SET task_list_id = '' WHERE task_list_id = ?`, listID)
-	_, _ = s.db.Exec(`DELETE FROM task_list_shares WHERE task_list_id = ?`, listID)
-	_, err := s.db.Exec(`DELETE FROM task_lists WHERE id = ? AND user_id = ?`, listID, userID)
+	var owner string
+	if err := s.db.QueryRow(`SELECT user_id FROM task_lists WHERE id = ?`, listID).Scan(&owner); err != nil || owner != userID {
+		return errors.New("Aufgabenliste nicht gefunden")
+	}
+	// The tasks stay (as personal tasks of their owners), shares and the list go – all or nothing
+	if err := s.execInTx(
+		stmt(`UPDATE thoughts SET task_list_id = '' WHERE task_list_id = ?`, listID),
+		stmt(`DELETE FROM task_list_shares WHERE task_list_id = ?`, listID),
+		stmt(`DELETE FROM task_lists WHERE id = ? AND user_id = ?`, listID, userID),
+	); err != nil {
+		return err
+	}
 	s.PruneTaskAssignees()
-	return err
+	return nil
 }