a mis-pointed project is a sentence, not a 500 reported as a permission problem

the owner pointed a project at the platform's repo root — an easy mistake, since
`todo/` sits inside one — and got "the todo board is owner-only, and this account
was refused". three things were wrong and only one of them was the path.

A THEME IS NOW A DIRECTORY WITH AN `_index.md`. readTree assumed every subdirectory
was one, which was safe when the only possible root was the platform's own todo
folder and is not safe now. against a repo root it read `src/_index.md`, threw
ENOENT, and the route 500'd. skipping non-themes is also just correct for a real
todo folder, which may hold a README beside its themes.

THE ERROR MESSAGE WAS A LIE IT INHERITED. "owner-only, and this account was
refused" was true of `/todos` in the platform, where the permission was
`kind: 'admin'`. here it is grantable and there is no such gate — so the sentence
survived the extraction describing a rule that no longer exists, and the first real
failure it met was reported as a permission problem. it shows the actual error now.
a wrong explanation is worse than none: it sent the owner to check their own
account when the answer was in the panel beside them.

AND AN EMPTY FOLDER SAYS SO. no themes at all is almost always this same mistake,
so it names it — a theme is a directory with an `_index.md`, and if you pointed at
a repository the folder you want is usually `todo/` inside it. an empty board
otherwise reads as "no work outstanding", which is the opposite of the truth.

verified: repo root now 200 with 0 themes and the explanation; the real folder
reads 38 themes and 139 items.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/tree.ts

@@ -1,4 +1,4 @@
-import { readFileSync, readdirSync, writeFileSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, writeFileSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 
 // The todo tree: `todo/<theme>/<item>.md`, one item per file, frontmatter + hand-written prose.
@@ -88,6 +88,16 @@ export function patchFrontmatter(text: string, updates: Record<string, string>):
 export function readTree(root: string): { themes: TodoTheme[] } {
   const themes = readdirSync(root)
     .filter((d) => statSync(join(root, d)).isDirectory())
+    /*
+      A THEME is a directory with an `_index.md`. Anything else under the folder is ignored.
+
+      This used to assume every subdirectory was one, which was safe when the only possible root was the
+      platform's own `todo/`. It is not safe now: point a project at a repository root — an easy mistake,
+      since `todo/` sits inside one — and this read `src/_index.md`, threw ENOENT, and the board showed a
+      500 that the panel reported as a permission problem. Skipping is also just correct for a real todo
+      folder, which may hold a README or a script beside its themes.
+    */
+    .filter((d) => existsSync(join(root, d, '_index.md')))
     .sort()
     .map((theme) => {
       const files = readdirSync(join(root, theme)).filter((f) => f.endsWith('.md'));