Unit test suite over the service layer

Tests for each service-layer function, not just endpoint smoke tests - task creation validation, status transition rules (a done task cannot return to backlog without an explicit override), and authorization logic. Target meaningful coverage of business logic, not boilerplate.

Endpoint smoke tests tell you the wiring works. Service-layer tests tell you the rules are right, and they are the ones that still pass when you swap the web framework.