feat(m9): todo/kanban with DnD, assignee notify, completion, tests, e2e

- TodoRepository (column CRUD, item CRUD, soft-delete, ordering, maxOrderIndex,
  project isolation) + TodoService (lazy standard-column init, member/admin
  permission, create/update/move/toggleComplete/delete, todo_assigned notify,
  todo_created/updated/completed activity logs, SSE todo.updated)
- APIs: columns + items (GET/POST/PATCH/DELETE), toggleComplete + move
- KanbanBoard client (HTML5 drag&drop move, new task per column, complete),
  todos page, ProjectNav ToDo link
- Unit tests (TodoRepository, TodoService) + e2e todo-kanban

app/api/projects/[projectId]/todos/columns/[columnId]/route.ts

@@ -0,0 +1,49 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getCurrentUser } from '@/lib/auth/getCurrentUser';
+import { createTodoService } from '@/lib/api/services';
+import { UnauthorizedError } from '@/lib/errors';
+import { handleApiError, jsonError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function PATCH(
+  request: NextRequest,
+  { params }: { params: Promise<{ projectId: string; columnId: string }> }
+) {
+  const user = await getCurrentUser();
+  if (!user) return handleApiError(new UnauthorizedError());
+  const { columnId } = await params;
+  let body: Record<string, unknown>;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    return jsonError(400, 'リクエスト本文が不正です');
+  }
+  const service = createTodoService();
+  try {
+    const column = service.updateColumn(user.id, Number(columnId), {
+      name: typeof body.name === 'string' ? body.name : undefined,
+      orderIndex:
+        typeof body.orderIndex === 'number' ? body.orderIndex : undefined,
+    });
+    return NextResponse.json({ column });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}
+
+export async function DELETE(
+  _request: NextRequest,
+  { params }: { params: Promise<{ projectId: string; columnId: string }> }
+) {
+  const user = await getCurrentUser();
+  if (!user) return handleApiError(new UnauthorizedError());
+  const { columnId } = await params;
+  const service = createTodoService();
+  try {
+    service.deleteColumn(user.id, Number(columnId));
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}

app/api/projects/[projectId]/todos/columns/route.ts

@@ -0,0 +1,51 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getCurrentUser } from '@/lib/auth/getCurrentUser';
+import { createTodoService } from '@/lib/api/services';
+import { UnauthorizedError } from '@/lib/errors';
+import { handleApiError, jsonError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function GET(
+  _request: NextRequest,
+  { params }: { params: Promise<{ projectId: string }> }
+) {
+  const user = await getCurrentUser();
+  if (!user) return handleApiError(new UnauthorizedError());
+  const { projectId } = await params;
+  const service = createTodoService();
+  try {
+    return NextResponse.json({
+      columns: service.getColumns(user.id, Number(projectId)),
+    });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ projectId: string }> }
+) {
+  const user = await getCurrentUser();
+  if (!user) return handleApiError(new UnauthorizedError());
+  const { projectId } = await params;
+  let body: Record<string, unknown>;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    return jsonError(400, 'リクエスト本文が不正です');
+  }
+  const service = createTodoService();
+  try {
+    const column = service.createColumn(
+      user.id,
+      Number(projectId),
+      String(body.name ?? ''),
+      typeof body.orderIndex === 'number' ? body.orderIndex : undefined
+    );
+    return NextResponse.json({ column }, { status: 201 });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}

app/api/projects/[projectId]/todos/items/[itemId]/route.ts

@@ -0,0 +1,76 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getCurrentUser } from '@/lib/auth/getCurrentUser';
+import { createTodoService } from '@/lib/api/services';
+import { UnauthorizedError } from '@/lib/errors';
+import { handleApiError, jsonError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function PATCH(
+  request: NextRequest,
+  { params }: { params: Promise<{ projectId: string; itemId: string }> }
+) {
+  const user = await getCurrentUser();
+  if (!user) return handleApiError(new UnauthorizedError());
+  const { itemId } = await params;
+  let body: Record<string, unknown>;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    return jsonError(400, 'リクエスト本文が不正です');
+  }
+  const service = createTodoService();
+  try {
+    // complete は専用フラグでトグル、それ以外は通常更新
+    if (body.toggleComplete === true) {
+      const item = service.toggleComplete(user.id, Number(itemId));
+      return NextResponse.json({ item });
+    }
+    if (body.columnId !== undefined && body.orderIndex !== undefined) {
+      const item = service.moveItem(
+        user.id,
+        Number(itemId),
+        Number(body.columnId),
+        Number(body.orderIndex)
+      );
+      return NextResponse.json({ item });
+    }
+    const item = service.updateItem(user.id, Number(itemId), {
+      title: typeof body.title === 'string' ? body.title : undefined,
+      description:
+        typeof body.description === 'string' ? body.description : undefined,
+      assigneeId:
+        body.assigneeId === null || body.assigneeId === undefined
+          ? undefined
+          : Number(body.assigneeId),
+      priority:
+        typeof body.priority === 'string'
+          ? (body.priority as 'low' | 'normal' | 'high')
+          : undefined,
+      dueDate: typeof body.dueDate === 'string' ? body.dueDate : undefined,
+      milestoneId:
+        body.milestoneId === null || body.milestoneId === undefined
+          ? undefined
+          : Number(body.milestoneId),
+    });
+    return NextResponse.json({ item });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}
+
+export async function DELETE(
+  _request: NextRequest,
+  { params }: { params: Promise<{ projectId: string; itemId: string }> }
+) {
+  const user = await getCurrentUser();
+  if (!user) return handleApiError(new UnauthorizedError());
+  const { itemId } = await params;
+  const service = createTodoService();
+  try {
+    service.deleteItem(user.id, Number(itemId));
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}

app/api/projects/[projectId]/todos/items/route.ts

@@ -0,0 +1,60 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getCurrentUser } from '@/lib/auth/getCurrentUser';
+import { createTodoService } from '@/lib/api/services';
+import { UnauthorizedError } from '@/lib/errors';
+import { handleApiError, jsonError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function GET(
+  _request: NextRequest,
+  { params }: { params: Promise<{ projectId: string }> }
+) {
+  const user = await getCurrentUser();
+  if (!user) return handleApiError(new UnauthorizedError());
+  const { projectId } = await params;
+  const service = createTodoService();
+  try {
+    return NextResponse.json({
+      items: service.getItems(user.id, Number(projectId)),
+    });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ projectId: string }> }
+) {
+  const user = await getCurrentUser();
+  if (!user) return handleApiError(new UnauthorizedError());
+  const { projectId } = await params;
+  let body: Record<string, unknown>;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    return jsonError(400, 'リクエスト本文が不正です');
+  }
+  const service = createTodoService();
+  try {
+    const item = service.createItem(user.id, Number(projectId), {
+      title: String(body.title ?? ''),
+      columnId: Number(body.columnId ?? 0),
+      description:
+        typeof body.description === 'string' ? body.description : undefined,
+      assigneeId:
+        body.assigneeId === null || body.assigneeId === undefined
+          ? null
+          : Number(body.assigneeId),
+      priority:
+        typeof body.priority === 'string'
+          ? (body.priority as 'low' | 'normal' | 'high')
+          : undefined,
+      dueDate: typeof body.dueDate === 'string' ? body.dueDate : null,
+    });
+    return NextResponse.json({ item }, { status: 201 });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}

app/projects/[projectId]/todos/page.tsx

@@ -0,0 +1,49 @@
+import { redirect } from 'next/navigation';
+import { getCurrentUser, toPublicUser } from '@/lib/auth/getCurrentUser';
+import { createTodoService, createProjectService } from '@/lib/api/services';
+import { Header } from '@/components/layout/Header';
+import { ProjectNav } from '@/components/layout/ProjectNav';
+import { KanbanBoard } from '@/components/todo/KanbanBoard';
+import { ForbiddenError, NotFoundError } from '@/lib/errors';
+
+export const dynamic = 'force-dynamic';
+
+export default async function TodosPage({
+  params,
+}: {
+  params: Promise<{ projectId: string }>;
+}) {
+  const user = await getCurrentUser();
+  if (!user) redirect('/login');
+  const { projectId } = await params;
+
+  const projectService = createProjectService();
+  let project: Awaited<ReturnType<typeof projectService.getProject>>;
+  try {
+    project = projectService.getProject(user.id, Number(projectId));
+  } catch (error) {
+    if (error instanceof ForbiddenError || error instanceof NotFoundError) {
+      redirect('/dashboard');
+    }
+    throw error;
+  }
+
+  const todoService = createTodoService();
+  const columns = todoService.getColumns(user.id, project.id);
+  const items = todoService.getItems(user.id, project.id);
+
+  return (
+    <div className="min-h-screen bg-gray-50">
+      <Header user={toPublicUser(user)} />
+      <ProjectNav projectId={project.id} active="todos" />
+      <main className="space-y-4 p-6">
+        <h1 className="text-2xl font-bold">ToDo / Kanban</h1>
+        <KanbanBoard
+          projectId={project.id}
+          columns={columns}
+          initialItems={items}
+        />
+      </main>
+    </div>
+  );
+}