refactor: split sqlite.go and server.go by domain (FLAW-20)

Pure moves, no behaviour change: the storage layer now has users,
apikeys, thoughts, tasklists, documents, folders, tags, lists, teams and
system files next to sqlite.go (store, schema, migrations); the API has
handlers_*.go per area plus realtime.go and alarms.go next to server.go
(server, router, middleware). Declarations were moved verbatim with an
AST-based tool; imports pruned with goimports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_tasklists.go

@@ -0,0 +1,158 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/sandrodach/mindsift/internal/auth"
+	"github.com/sandrodach/mindsift/internal/domain"
+)
+
+// --- TASK LISTS ---
+
+func (s *Server) handleGetTaskLists(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	lists, err := s.store.GetTaskLists(userID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, lists)
+}
+
+func (s *Server) handleCreateTaskList(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	var req struct {
+		SpaceID string `json:"spaceId"`
+		TeamID  string `json:"teamId"`
+		Title   string `json:"title"`
+		Icon    string `json:"icon"`
+		Color   string `json:"color"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
+		return
+	}
+	tl, err := s.store.CreateTaskList(userID, req.SpaceID, req.TeamID, req.Title, req.Icon, req.Color)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusCreated, tl)
+}
+
+func (s *Server) handleUpdateTaskList(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	var req struct {
+		Title   *string                `json:"title"`
+		Icon    *string                `json:"icon"`
+		Color   *string                `json:"color"`
+		SpaceID *string                `json:"spaceId"`
+		Columns *[]domain.KanbanColumn `json:"columns"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
+		return
+	}
+	audienceBefore := s.store.GetTaskListUserIDs(listID)
+	tl, err := s.store.UpdateTaskList(userID, listID, req.Title, req.Icon, req.Color, req.SpaceID, req.Columns)
+	if err != nil {
+		writeStoreError(w, http.StatusBadRequest, err)
+		return
+	}
+	s.broadcastTaskListChange(listID, audienceBefore, "TASK_LIST_UPDATED")
+	writeJSON(w, http.StatusOK, tl)
+}
+
+func (s *Server) handleDeleteTaskList(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	audienceBefore := s.store.GetTaskListUserIDs(listID)
+	if err := s.store.DeleteTaskList(userID, listID); err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	s.broadcastTaskListChange(listID, audienceBefore, "TASK_LIST_DELETED")
+	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
+}
+
+func (s *Server) handleGetTaskListShares(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	if _, err := s.store.GetTaskListByID(userID, listID); err != nil {
+		writeError(w, http.StatusNotFound, "Aufgabenliste nicht gefunden oder kein Zugriff")
+		return
+	}
+	shares, err := s.store.GetTaskListShares(listID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, shares)
+}
+
+func (s *Server) handleCreateTaskListShare(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	tl, err := s.store.GetTaskListByID(userID, listID)
+	if err != nil || tl == nil {
+		writeError(w, http.StatusNotFound, "Aufgabenliste nicht gefunden")
+		return
+	}
+	if tl.UserID != userID {
+		writeError(w, http.StatusForbidden, "Nur der Eigentümer kann die Liste freigeben")
+		return
+	}
+	var req struct {
+		TargetType string `json:"targetType"` // team | user
+		TargetID   string `json:"targetId"`
+		Permission string `json:"permission"` // editor | viewer
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
+		return
+	}
+	permission := strings.ToLower(strings.TrimSpace(req.Permission))
+	if permission != "viewer" {
+		permission = "editor"
+	}
+	share, err := s.store.AddTaskListShare(listID, req.TargetType, req.TargetID, permission, userID)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	s.broadcastTaskListChange(listID, nil, "TASK_LIST_UPDATED")
+	writeJSON(w, http.StatusCreated, share)
+}
+
+func (s *Server) handleDeleteTaskListShare(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	listID := chi.URLParam(r, "id")
+	shareID := chi.URLParam(r, "shareId")
+	tl, err := s.store.GetTaskListByID(userID, listID)
+	if err != nil || tl == nil {
+		writeError(w, http.StatusNotFound, "Aufgabenliste nicht gefunden")
+		return
+	}
+	if tl.UserID != userID {
+		writeError(w, http.StatusForbidden, "Nur der Eigentümer kann Freigaben entfernen")
+		return
+	}
+	audienceBefore := s.store.GetTaskListUserIDs(listID)
+	if err := s.store.RemoveTaskListShare(listID, shareID); err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	s.broadcastTaskListChange(listID, audienceBefore, "TASK_LIST_UPDATED")
+	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
+}
+
+// broadcastTaskListChange notifies everyone who could see the list before or can see it now. Only the ID is sent,
+// because the list payload depends on the receiver's permission; clients reload their lists.
+func (s *Server) broadcastTaskListChange(listID string, audienceBefore []string, event string) {
+	users := append(audienceBefore, s.store.GetTaskListUserIDs(listID)...)
+	s.wsHub.BroadcastToUsers(users, event, map[string]string{"id": listID})
+}