Looking at the request-id on the backend. Your user token did not have the correct permissions. You only had user.read.
To call teh /todo endpoint as per the docs, you'll need to consent to Tasks.ReadWrite. https://learn.microsoft.com/en-us/graph/api/todo-list-lists?view=graph-rest-1.0
If you're doing this just in Graph Explorer, there is a Modify Permissions tab where you can consent this permission.