LIVE https://todo-go.bfj.oncarlos.com 8a42c8d

## Checks (review round, 8a42c8d)

- `make test` passes, including new tests for unissued cookies and the lists migration.
- Shared suite locally: 67 passed, 3 skipped. Boot-check: `/healthz` 200, `/api/version` 200 `8a42c8d`, clean exit on SIGTERM.
- `make deploy` swapped to `8a42c8d`; `/api/version` reads `8a42c8d`. Shared suite against the live host: 67 passed, 3 skipped. No errors in `carlos errors`.

## Review findings fixed

1. **Unissued cookies accepted.** Issued lists are now recorded in a new
   `todo_lists` table (migration 2, additive). A cookie whose hash isn't
   there gets a fresh random cookie and an empty list. The migration
   copies in every list that already held todos, so existing visitors
   keep theirs.
2. **Mid-edit redraw discarded the draft.** `swap()` in `app.js` now
   carries any open, not-yet-saving edit (its draft, focus and cursor)
   into the redrawn list, and ignores the focusout that removing the
   old field can fire. Checked in a browser: with a toggle's response
   held back, editing another item and then letting the response land
   keeps the edit open with its draft, and Enter saves it.

## Review findings not fixed

None.

## Checks (first build, 475f799)

- `make test`: passes (stylesheet byte check, `go vet`, Go tests for the store and the handlers).
- Shared suite on a local build at 475f799: 67 passed, 3 skipped (the two JS-only edit tests with JS off, and the screenshot test with JS off).
- `scripts/boot-check.sh dist/app-linux-arm64`: `/healthz` 200, `/api/version` 200 `475f799`, clean exit on SIGTERM.
- `make deploy`: shipped, promoted to `edge` and swapped. `/api/version` and `X-Carlos-Version` both read `475f799`.
- Shared suite against the live host: 67 passed, 3 skipped. `carlos errors` and `carlos availability` show nothing in the last hour.

## Notes

- The app and its instance already existed from a superseded pilot,
  serving `d9bf9fc` with a 2.2 MB database. That database wasn't
  touched. This build's tables are named `todo_items` and
  `todo_migrations` so they can't collide with whatever the pilot
  created, and a test covers opening beside foreign tables.
- `carlos apps build-probe /api/version` was set again (it's
  idempotent). `apps create` and `instances enable/create` weren't
  needed.