Add input validation to POST /tasks

[aj-enns]

Why

POST /tasks passed req.body.title straight into the store with no validation, so a request with a missing, empty, or non-string title still returned 201 and created a task with a bad (or undefined) title. This adds proper input validation so malformed requests are rejected before anything is stored.

What changed

• Validation in the route handler (sample-app/src/tasks/routes.ts): the POST / handler now rejects a title that is missing, not a string, or empty/whitespace-only. Invalid requests get a 400 with a clear JSON error ({ error: "title is required and must be a non-empty string" }) and return early, so no task is created. On the happy path the title is trimmed before being stored.
• Tests (sample-app/src/app.test.ts): added coverage for whitespace trimming and for the invalid cases. Invalid types are covered with a table-driven test (number, null, boolean, array, object), each asserting 400 plus an empty task list afterward. The missing-title test asserts the exact error body to lock in the contract.

Notes

• The error shape { error: string } matches the existing 404 responses in the same router, so the response format stays consistent.
• Returning the trimmed title (rather than the raw input) is intentional to avoid storing accidental leading/trailing whitespace.
• Out of scope for this small demo API: max-length limits and zero-width/invisible-unicode blanks.

All 16 tests pass and npm run typecheck is clean.

Fixes: #1

[aj-enns]

Closed by reset-demo cleanup