Evaluate TodoService support for model based update of state

TodoService uses update_state on Todo to update a state. This is based on / needs a relation.

Within our GraphQL authorization helper methods we return a model (not a relation). As a temporary solution we have used Todo.where(id: todo.id) to create a relation. So we might need to add support for this to TodoService.

If it turns out we won't need any other updates (cache?) a simple update on the model could work as well.