- Add hasAccess middleware to note/task GET by id endpoints
- Ensure 403 Forbidden when user lacks access to existing resources
- Preserve 404 for genuinely missing IDs
- Update list queries to include shared items via ownershipOrPermissionWhere
- Align subtasks endpoint to return 403 when parent not accessible
- Update integration tests accordingly
* Initial migration
* Cleanup and create migration scripts
* Introduce test suite
* Fix test issues
* Correct CORS issue and update paths
* Update README