feat: comprehensive tests, bug fixes, and PATCH /tasks/:id/assign implementation

[KrutagyaKaneria]

Summary

Adds a full test suite (102 tests, 97% coverage), fixes 3 bugs discovered through testing, and implements the new PATCH /tasks/:id/assign endpoint with validation and tests.

---

Tests

File	Type	Tests
taskService.test.js	Unit	28
validators.test.js	Unit	24
api.test.js	Integration (Supertest)	50

Coverage: 97.43% statements · 91.66% branches · 93.33% functions · 97.18% lines

---

Bug Fixes

1. completeTask overwrites priority (taskService.js:69) — Fixed

Completing a task silently reset priority to 'medium', destroying the original value. Removed the hardcoded priority: 'medium' line so the spread preserves the task's existing priority.

2. getPaginated wrong offset (taskService.js:12) — Fixed

Offset was calculated as page * limit instead of (page - 1) * limit. Page 1 skipped the first limit items entirely, making pagination unusable.

3. update allows overwriting immutable fields (taskService.js:50) — Fixed

PUT /tasks/:id spread the raw request body over the task, allowing clients to overwrite id and createdAt. Now only whitelisted fields (title, description, status, priority, dueDate) are applied.

---

New Feature: PATCH /tasks/:id/assign

PATCH /tasks/:id/assign
Body: { "assignee": "Alice" }

Design decisions:

• assignee must be a non-empty string — empty/whitespace-only returns 400
• Input is trimmed before storage (no leading/trailing whitespace)
• Reassignment is allowed (overwrites previous assignee) — tasks can be reassigned
• assignedAt timestamp recorded for audit trail
• Returns 404 if task doesn't exist
• Full test coverage (7 unit + 7 integration tests)

---

Additional Bugs Documented (not fixed)

Two more bugs were identified and documented in BUGS.md:

• getByStatus uses .includes() instead of === — partial string matching causes ?status=do to match both todo and done
• README documentation mismatch — docs say pending/in-progress/completed but code uses todo/in_progress/done