Task + goal tracker: private tasks schema, /trackers/tasks page, idempotent seed import (daisy-import)

src/lib/server/owner.ts

@@ -19,7 +19,11 @@ export function requireOwner(event: OwnerEvent) {
 }
 
 /** Paths that only the owner may see (checked in hooks.server.ts before any route runs). */
-export const ownerOnlyPrefixes = ['/trackers/health', '/trackers/books/files'] as const;
+export const ownerOnlyPrefixes = [
+	'/trackers/health',
+	'/trackers/tasks',
+	'/trackers/books/files'
+] as const;
 
 /**
  * Owner-only paths inside otherwise public areas: the book reader and its progress/notes
@@ -31,7 +35,11 @@ export const ownerOnlyPatterns = [/^\/trackers\/books\/\d+\/(read|progress|notes
  * Areas where only the owner may write: any non-GET request from anyone else is refused
  * (404) in hooks.server.ts, which also covers form actions on the public book pages.
  */
-export const ownerWritePrefixes = ['/trackers/health', '/trackers/books'] as const;
+export const ownerWritePrefixes = [
+	'/trackers/health',
+	'/trackers/tasks',
+	'/trackers/books'
+] as const;
 
 const normalise = (pathname: string) => pathname.toLowerCase().replace(/\/+$/, '');
 const under = (path: string, prefix: string) => path === prefix || path.startsWith(`${prefix}/`);