v1 slice 2: Create a list -> capability URL + owner

[JacksonMcDonaldDev]

Parent

#1

What to build

The first end-to-end list feature: create a list with no account and land on it at a secret URL. Introduce the List document (one Mongo document per list with embedded members and items, plus token, name, ownerToken, createdAt, lastActivityAt). Creating a list generates a cryptographically unguessable token, sets a signed owner cookie holding the list's ownerToken (this is what marks the creator as owner on their device), and redirects to the capability URL /l/<token>. Viewing that URL renders the list shell (empty for now). An unknown or malformed token returns 404.

The list name can be set as part of creation (or defaulted and made editable later). Every mutation should bump lastActivityAt (used later by inactivity expiry).

Acceptance criteria

• List schema exists with embedded members/items and the fields above
• Creating a list generates an unguessable capability token and redirects to /l/<token>
• The creator receives a signed owner cookie proving owner role on their device
• Visiting /l/<token> for an existing list renders the list shell
• An unknown/malformed token returns 404
• The list has a name captured at or shortly after creation
• Tests (supertest) cover: create yields a capability URL + owner cookie; unknown token 404s

Blocked by

• v1 slice 1: Foundation & teardown (remove old auth stack, htmx + test harness skeleton) #2