[Fix] Sidebar shows tasks owned by other users

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

Recent and pinned task IDs supplied to the sidebar search are now restricted to tasks initiated by the signed-in user. The DB-backed search regression test covers a mixed set of current-user and cross-user task IDs while preserving inclusion of the current user's pinned task.

Why this change was made

The normal sidebar search was user-scoped, but its explicit-ID fallback could return visible tasks initiated by other users. This made another user's task appear in recent sidebar results after its ID had been stored locally.

Impact

The web sidebar only shows tasks owned by the signed-in user, including when recent or pinned IDs are supplied. Cross-user task IDs are ignored by the server-side query.

[roomote-roomote]

1 issue outstanding. See task

• apps/web/src/lib/server/tasks.ts:521 Filtering includeIds by initiator hides existing cross-user pins. setTaskPinnedCommand explicitly allows every deployment member to pin any visible task, but pins are only removable from the sidebar; those hidden pins still consume the five-pin quota and cannot be unpinned.

_{Reviewed 6c48cb4}