Add get-task singular, move-task tool, and surface real Graph errors

[rathga]

Tools to unblock common MS Todo workflows via MCP — safe cross-list moves, full-fidelity task reads, and proper Graph error visibility. Smoke-tested end-to-end against live Graph.

What changed

1. feat(get-task) — singular lookup returning full task JSON
get-tasks truncates body.content to a 50-char preview, causing silent data loss when a caller tries to round-trip a task (read → recreate → delete). Rather than inflating every list row, get-task returns the raw todoTask JSON (full body, dates, etc.) so list views stay lean with full detail on demand.

2. fix(graph) — surface real Graph errors and harden $select
makeGraphRequest swallowed non-2xx responses, so Graph 400/404 bodies only reached stderr and MCP callers saw a generic "Failed to retrieve X". Now a module-scoped lastGraphError captures the full HTTP status + response body; get-tasks and get-task pull it into their user-visible response. normalizeSelect() also trims whitespace per field and auto-includes id (Graph 400s if $select omits it).

Related: makeGraphRequest now handles 204 No Content cleanly so DELETE/empty-body PATCH responses don't pollute lastGraphError with spurious JSON-parse errors.

3. feat(move-task) — atomic cross-list moves
MS Graph does not allow changing a todoTask's parentFolderId, so cross-list moves require create-in-target + delete-from-source. Doing that client-side is multiple tool calls and prone to partial failure. move-task does it in one call:

1. GET source with full fields
2. GET source's checklist items (subtasks)
3. POST copy into target list with all writable fields (title, body, dueDateTime, startDateTime, reminderDateTime, isReminderOn, completedDateTime, importance, status, categories, recurrence)
4. POST each checklist item into the new task
5. DELETE source — only after create succeeded

Fail-safe: if the target-list create fails, the source is untouched. If the source delete fails after a successful create, the new task is preserved and the response warns with the orphaned source task ID for manual cleanup. No silent duplicates, no silent data loss.

With sourceListId == targetListId, move-task effectively "bumps the task to the top of its list" (new tasks land at the top by default in MS Todo). This covers the most common prioritization workflow.

What's NOT included (and why)

orderHint: MS Graph does not expose orderHint on microsoft.graph.todoTask in either v1.0 or beta. Probing GET /me/todo/lists/{id}/tasks?$select=orderHint returns:

BadRequest: Could not find a property named 'orderHint' on type 'microsoft.graph.todoTask'.

A PATCH with orderHint returns 200 but silently ignores the field. Arbitrary task reordering is not achievable via the public Graph API. orderHint exists on plannerTask (different product, Planner) — not on todoTask.

Smoke test (live Graph)

Moved a disposable test task with rich body (206 chars), high importance, multiple categories, and a due date — between two real lists, round-tripped there and back, verifying every hop. 5/5 field-preservation checks pass:

• body.content NOT truncated via get-task (206 chars round-tripped intact)
• Within-list move preserves all fields
• Cross-list move preserves all fields
• Source task fully deleted after each move (404 on old ID)
• Full round-trip (A → B → A) preserves all fields

Verification

• npm run build clean
• Stdio smoke test confirms tool count is 13 → 15 (+get-task, +move-task)

Commits

1. get-task singular returning full task JSON
2. Graph error surfacing + $select whitespace normalization + auto-id
3. makeGraphRequest handles 204/empty-body without polluting lastGraphError
4. move-task tool for full-fidelity within/cross-list moves
5. Revert dead orderHint param (not supported by Graph on todoTask)