feat: add pure task operations and bounded undo stack

Task operations become pure functions over arrays.

Ids move from Date.now() to crypto.randomUUID(), with a fallback for
non-secure contexts, since people do self-host this over plain HTTP on a
LAN.

Undo gets its own module so tasks.js stays pure. It covers single deletes
and clear-completed batches, and clamps indices because the list can
change between recording an entry and undoing it.

src/lib/tasks.js

@@ -0,0 +1,41 @@
+/** crypto.randomUUID requires a secure context, and Negotium over plain HTTP
+ *  on a LAN is a real self-hosted deployment shape — hence the fallback. */
+function newId() {
+  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
+    return crypto.randomUUID()
+  }
+  return `${Date.now()}-${Math.random().toString(36).slice(2)}`
+}
+
+export function createTask(text, now = Date.now()) {
+  return { id: newId(), text, completed: false, createdAt: now }
+}
+
+export function addTask(tasks, text, now = Date.now()) {
+  const trimmed = text.trim()
+  if (!trimmed) return tasks
+  return [...tasks, createTask(trimmed, now)]
+}
+
+export function toggleTask(tasks, id) {
+  return tasks.map((task) => (task.id === id ? { ...task, completed: !task.completed } : task))
+}
+
+export function deleteTask(tasks, id) {
+  return tasks.filter((task) => task.id !== id)
+}
+
+export function reorderTask(tasks, from, to) {
+  if (from === to) return tasks
+  if (from < 0 || from >= tasks.length) return tasks
+  if (to < 0 || to >= tasks.length) return tasks
+
+  const next = [...tasks]
+  const [moved] = next.splice(from, 1)
+  next.splice(to, 0, moved)
+  return next
+}
+
+export function clearCompleted(tasks) {
+  return tasks.filter((task) => !task.completed)
+}