fix(api): return empty arrays not null for empty lists (frontend null.length crash)

Root cause: store List* methods used 'var out []T' which stays nil on empty
result sets and serializes to JSON null; the SPA then crashed on .length/.map
(e.g. endpoints.length on the Tasks page right after deploy). Return []T{}
at the source; coerce null->[] on the frontend load sites as defense-in-depth.
Regression test asserts List* are non-nil when empty.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MMHQTtnQtQqL8muAXHr9kd

internal/store/emptylist_test.go

@@ -0,0 +1,38 @@
+package store
+
+import (
+	"context"
+	"testing"
+)
+
+// Empty lists must serialize as JSON [] (non-nil slice), not null,
+// otherwise the frontend crashes on `.length`/`.map`. Regression for
+// "Uncaught TypeError: can't access property length, n is null".
+func TestListsNeverNilWhenEmpty(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+
+	eps, err := s.ListEndpoints(ctx)
+	if err != nil {
+		t.Fatalf("ListEndpoints: %v", err)
+	}
+	if eps == nil {
+		t.Fatal("ListEndpoints returned nil slice on empty DB (would serialize as null)")
+	}
+
+	tasks, err := s.ListTasks(ctx)
+	if err != nil {
+		t.Fatalf("ListTasks: %v", err)
+	}
+	if tasks == nil {
+		t.Fatal("ListTasks returned nil slice on empty DB (would serialize as null)")
+	}
+
+	accs, err := s.ListAccountsByTask(ctx, 999999)
+	if err != nil {
+		t.Fatalf("ListAccountsByTask: %v", err)
+	}
+	if accs == nil {
+		t.Fatal("ListAccountsByTask returned nil slice for no rows (would serialize as null)")
+	}
+}