feat(04-02): activate task integration tests (RED stubs to GREEN-ready)

- Remove t.Skip from TestTasksKanbanRenders, TestTaskCreate, TestTaskCreateValidation, TestTaskDelete, TestTaskOwnership
- Fix column header strings: 'To do'/'In progress'/'In review' to match TaskColumnLabels
- Add kanban-board id assertion and non-owner 404 check to TestTasksKanbanRenders
- TestTaskUpdate, TestTaskReorder*, TestTaskOrderPersists remain SKIP for Plan 03

backend/internal/web/handlers_tasks_test.go

@@ -35,10 +35,8 @@ func newTaskTestRouter(q *sqlc.Queries, store *auth.Store) http.Handler {
 // ---- TestTasksKanbanRenders (TASK-01) ----
 
 // TestTasksKanbanRenders verifies that GET /tablos/{id} by the owner renders
-// all four kanban column headers: Todo, In Progress, In Review, Done (TASK-01).
+// all four kanban column headers: To do, In progress, In review, Done (TASK-01).
 func TestTasksKanbanRenders(t *testing.T) {
-	t.Skip("handlers_tasks not yet implemented")
-
 	pool, cleanup := setupTestDB(t)
 	defer cleanup()
 
@@ -75,11 +73,27 @@ func TestTasksKanbanRenders(t *testing.T) {
 	}
 
 	body := rec.Body.String()
-	for _, col := range []string{"Todo", "In Progress", "In Review", "Done"} {
+	// Column labels as defined in TaskColumnLabels (tasks_forms.go).
+	for _, col := range []string{"To do", "In progress", "In review", "Done"} {
 		if !strings.Contains(body, col) {
 			t.Errorf("kanban board missing column header %q", col)
 		}
 	}
+	if !strings.Contains(body, "kanban-board") {
+		t.Errorf("kanban board missing id=kanban-board")
+	}
+
+	// Non-owner should get 404.
+	nonOwner := preInsertUser(t, ctx, q, "kanban-other@example.com", "correct-horse-12")
+	nonOwnerCookieVal, _, _ := store.Create(ctx, nonOwner.ID)
+	nonOwnerCookie := &http.Cookie{Name: auth.SessionCookieName, Value: nonOwnerCookieVal}
+	req2 := httptest.NewRequest(http.MethodGet, "/tablos/"+tablo.ID.String(), nil)
+	req2.AddCookie(nonOwnerCookie)
+	rec2 := httptest.NewRecorder()
+	router.ServeHTTP(rec2, req2)
+	if rec2.Code != http.StatusNotFound {
+		t.Errorf("non-owner GET /tablos/{id}: status = %d; want 404", rec2.Code)
+	}
 }
 
 // ---- TestTaskCreate (TASK-02) ----
@@ -87,8 +101,6 @@ func TestTasksKanbanRenders(t *testing.T) {
 // TestTaskCreate verifies that POST /tablos/{id}/tasks creates a task and
 // returns a 200 response with an HTMX card fragment (TASK-02).
 func TestTaskCreate(t *testing.T) {
-	t.Skip("handlers_tasks not yet implemented")
-
 	pool, cleanup := setupTestDB(t)
 	defer cleanup()
 
@@ -155,8 +167,6 @@ func TestTaskCreate(t *testing.T) {
 // TestTaskCreateValidation verifies that POST /tablos/{id}/tasks with an empty
 // title returns 422 with an error message (TASK-02 validation).
 func TestTaskCreateValidation(t *testing.T) {
-	t.Skip("handlers_tasks not yet implemented")
-
 	pool, cleanup := setupTestDB(t)
 	defer cleanup()
 
@@ -454,8 +464,6 @@ func TestTaskReorderSameColumn(t *testing.T) {
 // TestTaskDelete verifies that POST /tablos/{id}/tasks/{task_id}/delete removes
 // the task and returns an empty div (TASK-06).
 func TestTaskDelete(t *testing.T) {
-	t.Skip("handlers_tasks not yet implemented")
-
 	pool, cleanup := setupTestDB(t)
 	defer cleanup()
 
@@ -614,8 +622,6 @@ func TestTaskOrderPersists(t *testing.T) {
 // TestTaskOwnership verifies that GET and POST task routes accessed by a
 // non-owner return 404 (no information leakage, D-04) (T-04-IDOR).
 func TestTaskOwnership(t *testing.T) {
-	t.Skip("handlers_tasks not yet implemented")
-
 	pool, cleanup := setupTestDB(t)
 	defer cleanup()