fix: resolve adaptiveSettings schema bug and task ownership BOLA vulnerability

[Pratik-kr21]

Description

This PR addresses two critical issues within the Routine management system: a major feature-breaking schema bug and a high-severity security vulnerability.

1. Adaptive Settings Schema Bug

Root Cause: In backend/src/models/Routine.js, the adaptiveSettings object was accidentally defined inside the configuration options of the day field due to a misplaced brace. Mongoose's strict mode dropped this unmapped object silently.
Solution: Moved the adaptiveSettings block out of the items array and placed it at the root level of the routineSchema.
User Impact: Completely restores the app's flagship "Interactive Contribution Heatmap" and adaptive tracking features. Without this fix, all routines save with a 0 burnout and consistency score.

2. Routine Task Ownership (BOLA) Vulnerability

Root Cause: The createRoutine and updateRoutine endpoints in backend/controllers/routineController.js accepted an array of tasks without verifying if the taskIds provided actually belonged to the authenticated user.
Solution: Imported the Task model and implemented a strict security checkpoint. The controller now counts the valid tasks owned by the userId using Task.countDocuments() and matches it against the unique taskIds requested. It rejects unowned tasks with a 403 Forbidden.
User Impact: Prevents malicious actors from mapping foreign task IDs to their routines to leak private task descriptions and statuses belonging to other users.

Files Modified

• backend/src/models/Routine.js
• backend/controllers/routineController.js

Related Issue

Closes #1484

Testing Checklist

• I have read CONTRIBUTING.md
• My branch follows the naming convention (fix/*)
• Testing Fix 1: Created a routine and verified that adaptiveSettings (burnout score, consistency score) successfully saves to the root of the MongoDB document.
• Testing Fix 2: Attempted to create a routine using a completely random taskId or one belonging to a different user, and verified the server explicitly rejects the request with a 403 Forbidden status.
• Verified no unrelated code changes or syntax errors were introduced.

[Pratik-kr21]

Hi maintainers 👋
This PR fixes two critical issues:

Resolves the adaptiveSettings schema nesting bug that was preventing adaptive tracking data from being saved correctly.
Fixes a BOLA/IDOR vulnerability by validating task ownership before routine creation/update.

The changes have been tested and are backward compatible. I would appreciate a review when you have time. Thank you! 🙌

[aryandas2911]

there are duplicates in the code fix that

[aryandas2911]

lint pls