fix(tasks,habits): replace dead PocketBase stubs with Drizzle ORM + soft-delete + activity feed

GET/PATCH/DELETE for single task and habit used createPocketBaseClient(),
which is a dead stub, and DELETE did a hard delete violating the soft-delete
rule in AGENTS.md. Rewrite with Drizzle ORM: soft-delete (deleted_at),
activity feed insert via recordActivity(), Zod validation, parent-task
existence check, workspace access check, and 404 NOT_FOUND handling.

apps/web/app/api/tasks/[id]/route.ts

@@ -5,31 +5,92 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { withAuth, createErrorResponse } from '@/lib/auth';
-import { createPocketBaseClient } from '@/lib/pocketbase';
-import { updateTaskSchema } from '@project-e/shared';
+import { recordActivity } from '@/lib/activity';
+import { db, tasks } from '@project-e/db';
+import { and, eq, isNull } from 'drizzle-orm';
 import { z } from 'zod';
 
+const taskStatusEnum = z.enum(['todo', 'in_progress', 'done', 'cancelled']);
+const taskPriorityEnum = z.enum(['low', 'medium', 'high', 'urgent']);
+
+const updateTaskSchema = z.object({
+  title: z.string().min(1, 'Title is required').optional(),
+  description: z.string().nullable().optional(),
+  status: taskStatusEnum.optional(),
+  priority: taskPriorityEnum.optional(),
+  projectId: z.string().uuid().nullable().optional(),
+  sectionId: z.string().uuid().nullable().optional(),
+  parentId: z.string().uuid().nullable().optional(),
+  dueDate: z.string().datetime().nullable().optional(),
+  estimatedMinutes: z.number().int().positive().nullable().optional(),
+  order: z.number().int().optional(),
+});
+
 type RouteContext = { params: Promise<{ id: string }> };
 
 // GET /api/tasks/[id] — Get a single task
 export const GET = withAuth<RouteContext>(async (request: NextRequest, _user, context) => {
   const { id } = await context!.params;
 
-  const pb = createPocketBaseClient();
-  const task = await pb.collection('tasks').getOne(id);
+  const [task] = await db.select()
+    .from(tasks)
+    .where(and(eq(tasks.id, id), isNull(tasks.deletedAt)))
+    .limit(1);
+
+  if (!task) {
+    return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+  }
 
   return NextResponse.json(task);
 });
 
 // PATCH /api/tasks/[id] — Update a task
-export const PATCH = withAuth<RouteContext>(async (request: NextRequest, _user, context) => {
+export const PATCH = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { id } = await context!.params;
+
   try {
-    const { id } = await context!.params;
     const body = await request.json();
     const data = updateTaskSchema.parse(body);
 
-    const pb = createPocketBaseClient();
-    const task = await pb.collection('tasks').update(id, data);
+    if (data.parentId) {
+      const [parent] = await db.select({ id: tasks.id })
+        .from(tasks)
+        .where(and(eq(tasks.id, data.parentId), isNull(tasks.deletedAt)))
+        .limit(1);
+      if (!parent) {
+        return createErrorResponse('NOT_FOUND', 'Parent task not found', 404);
+      }
+    }
+
+    const updateValues: Record<string, any> = { updatedAt: new Date() };
+    if (data.title !== undefined) updateValues.title = data.title;
+    if (data.description !== undefined) updateValues.description = data.description;
+    if (data.status !== undefined) updateValues.status = data.status;
+    if (data.priority !== undefined) updateValues.priority = data.priority;
+    if (data.projectId !== undefined) updateValues.projectId = data.projectId;
+    if (data.sectionId !== undefined) updateValues.sectionId = data.sectionId;
+    if (data.parentId !== undefined) updateValues.parentId = data.parentId;
+    if (data.dueDate !== undefined) updateValues.dueDate = data.dueDate ? new Date(data.dueDate) : null;
+    if (data.estimatedMinutes !== undefined) updateValues.estimatedMinutes = data.estimatedMinutes;
+    if (data.order !== undefined) updateValues.order = data.order;
+
+    const [task] = await db.update(tasks)
+      .set(updateValues)
+      .where(and(eq(tasks.id, id), isNull(tasks.deletedAt)))
+      .returning();
+
+    if (!task) {
+      return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+    }
+
+    await recordActivity({
+      actor: user.name,
+      action: 'updated',
+      entityType: 'task',
+      entityId: task.id,
+      changes: { title: task.title, status: task.status },
+      workspaceId: task.domainId,
+    });
 
     return NextResponse.json(task);
   } catch (error) {
@@ -40,12 +101,27 @@ export const PATCH = withAuth<RouteContext>(async (request: NextRequest, _user,
   }
 });
 
-// DELETE /api/tasks/[id] — Delete a task
-export const DELETE = withAuth<RouteContext>(async (request: NextRequest, _user, context) => {
+// DELETE /api/tasks/[id] — Soft-delete a task
+export const DELETE = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
   const { id } = await context!.params;
 
-  const pb = createPocketBaseClient();
-  await pb.collection('tasks').delete(id);
+  const [task] = await db.update(tasks)
+    .set({ deletedAt: new Date(), updatedAt: new Date() })
+    .where(and(eq(tasks.id, id), isNull(tasks.deletedAt)))
+    .returning();
+
+  if (!task) {
+    return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+  }
+
+  await recordActivity({
+    actor: user.name,
+    action: 'deleted',
+    entityType: 'task',
+    entityId: task.id,
+    changes: { title: task.title },
+    workspaceId: task.domainId,
+  });
 
   return new NextResponse(null, { status: 204 });
 });