Task Store: Ownership

Extend the store: update(id, patch, userId) and remove(id, userId) — both enforce ownership: if the task exists but ownerId !== userId, return { ok: false, status: 403 }; missing task => { ok: false, status: 404 }. update applies only title and done from patch (ignore other fields) and returns { ok: true, task }; remove returns { ok: true } and actually removes.

Difficulty: intermediate