Protect read-modify-write cycles in handle_add/remove/move and
consistent reads in /api/list with _list_lock to prevent data loss
when multiple users modify lists simultaneously.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>