feat(tasks): assign tasks in shared lists, unified people search, list avatars

- Tasks in shared task lists can be assigned to one or more people with access
  (task_assignees); assignments are pruned whenever access is lost
- UserAutocomplete: type-to-search everywhere, nothing before typing, max 3 results,
  first match preselected
- Task list and list tabs: avatar stack of members and round monochrome counter
- Shared list items remember who added them (list_items.created_by)
- Doku/ui-patterns.md documents the shared UI patterns

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server.go

@@ -299,7 +299,7 @@ func writeError(w http.ResponseWriter, status int, message string) {
 
 // writeStoreError maps read-only task list violations to 403 and everything else to the given fallback status.
 func writeStoreError(w http.ResponseWriter, fallbackStatus int, err error) {
-	if errors.Is(err, storage.ErrTaskListReadOnly) {
+	if errors.Is(err, storage.ErrTaskListReadOnly) || errors.Is(err, storage.ErrAssigneeNoAccess) {
 		writeError(w, http.StatusForbidden, err.Error())
 		return
 	}
@@ -914,6 +914,7 @@ func (s *Server) handleUpdateThought(w http.ResponseWriter, r *http.Request) {
 		Notes        *string           `json:"notes"`
 		Subtasks     *[]domain.SubTask `json:"subtasks"`
 		Tags         *[]string         `json:"tags"`
+		Assignees    *[]string         `json:"assignees"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
@@ -926,6 +927,14 @@ func (s *Server) handleUpdateThought(w http.ResponseWriter, r *http.Request) {
 		writeStoreError(w, http.StatusBadRequest, err)
 		return
 	}
+	if req.Assignees != nil {
+		assignees, err := s.store.SetTaskAssignees(userID, thoughtID, *req.Assignees)
+		if err != nil {
+			writeStoreError(w, http.StatusBadRequest, err)
+			return
+		}
+		updated.Assignees = assignees
+	}
 	if docID := s.store.SyncDocBlockAndTask(userID, thoughtID, updated.IsCompleted); docID != "" {
 		_, head, _ := s.store.GetDocOpsSince(docID, 0, 0)
 		s.notifyDocChanged(docID, head)
@@ -1652,6 +1661,7 @@ func (s *Server) handleDeleteListShare(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handleCreateListItem(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
 	listID := chi.URLParam(r, "id")
 	var req struct {
 		Content  string `json:"content"`
@@ -1663,7 +1673,7 @@ func (s *Server) handleCreateListItem(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	item, err := s.store.CreateListItem(listID, req.Content, req.Category, req.Quantity, 0)
+	item, err := s.store.CreateListItem(listID, req.Content, req.Category, req.Quantity, 0, userID)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return