refactor(04-01): move API list test stubs into tests/ mirror dir to match convention

The two Wave-0 RED stubs (lists.test.ts, listEmitter.test.ts) were co-located in
src/ but all existing API tests live in apps/api/tests/. Move them to tests/routes/
and tests/lib/, add explicit vitest imports to match the tests/ convention, and
update path references in downstream plans 04-02..04-06. PWA tests keep co-location
(that IS the PWA convention).

apps/api/src/lib/listEmitter.test.ts

@@ -1,19 +0,0 @@
-/**
- * Wave-0 RED stubs for listEmitter (in-memory EventEmitter fan-out).
- *
- * Covers D-04: SSE fan-out MUST be scoped to who can see a list.
- * These are pure-unit tests — no DB or HTTP server needed.
- *
- * Downstream plans implement the actual listEmitter.ts module that these stubs test.
- *
- * Run: pnpm --filter @familysync/api test
- */
-
-describe('listEmitter — scoped fan-out correctness (D-04)', () => {
-  it.todo('publishListEvent emits only to subscribers for the matching listId')
-  it.todo('publishListEvent does NOT emit to subscribers for a different listId')
-  it.todo('subscribeListEvents returns an unsubscribe function that stops future events')
-  it.todo('unsubscribed handler is not called after unsubscribe()')
-  it.todo('multiple subscribers for the same listId all receive the event')
-  it.todo('emitter handles 100+ concurrent subscribers without error (D-18 scale check)')
-})

apps/api/src/routes/lists.test.ts

@@ -1,42 +0,0 @@
-/**
- * Wave-0 RED stubs for the lists API router.
- *
- * These stubs cover LIST-01 through LIST-04 behavior.
- * Downstream plans (02/03/06) replace the `it.todo` entries with real assertions
- * once the routes and DB are wired.
- *
- * Security focus: T-04-02 — scoped fan-out (private list events must NOT reach non-owner).
- *
- * Run: pnpm --filter @familysync/api test
- */
-
-describe('GET /api/lists — LIST-01: returns only accessible lists', () => {
-  it.todo('returns empty array when user has no lists')
-  it.todo('returns lists owned by the current user')
-  it.todo('returns lists shared with the current user via list_shares')
-  it.todo('does NOT return private lists owned by another user')
-})
-
-describe('POST /api/lists — LIST-01: create list', () => {
-  it.todo('creates a list and inserts a list_shares row when isShared=true (D-01)')
-  it.todo('creates a private list with no list_shares row when isShared=false')
-  it.todo('rejects a name longer than 255 characters with 422')
-  it.todo('returns 401 when called without a session')
-})
-
-describe('PATCH /api/list-items/:id — LIST-02: per-field update', () => {
-  it.todo('updates only the checked field when patch body is { checked: true } (D-08)')
-  it.todo('updates only the text field when patch body is { text: "..." } (D-08)')
-  it.todo('rejects a patch body with more than one field with 422')
-  it.todo('returns 403 when caller does not own or share the parent list (T-04-02)')
-})
-
-describe('PATCH /api/list-items/:id rank — LIST-03: fractional reorder', () => {
-  it.todo('updates the rank field to the new fractional-indexing string')
-  it.todo('rejects an empty rank string with 422')
-})
-
-describe('SSE scoped fan-out — LIST-04 / T-04-02: private-list event isolation', () => {
-  it.todo('publishListEvent on a private list does NOT emit to a subscriber for a different list')
-  it.todo('publishListEvent on a shared list emits to all subscribers for that list')
-})