feat: phase r1+r2 recovery + r3-0 swiftly api ingestion

R1 stabilization: pytest harness with transactional db fixture, smoke
+ alembic + auth + scrape + approval + swiftly tests, github actions
ci yaml. Bearer-token admin auth + signed-cookie session for family
ui mutations. Async POST /api/admin/scrape (BackgroundTasks, returns
202). Path canonicalization (no /list, /planned suffixes). DATABASE_URL
fail-fast on empty.

R2 deferred-risk spikes: live lucky california fetch (R2-A), full
email+per-voter approval click round trip with single-use enforcement
(R2-B, console email backend, sendgrid stub).

R3-0 phase 3 redesign: replaced playwright html scraper with requests
based swiftly json api client. 17 categories, ~10k products per scrape,
upsert by (source, external_id). 401 surfaces actionable token-refresh
message via ScrapeLog.error_message.

Pre-existing defects fixed: shopping_list.py syntax error blocking app
import, MealPlan.votes orphan relationship, JSONB(astext=True) invalid
kwarg, missing requests dep, calorie_target schema drift, every SQLEnum
needed values_callable, 0001 had empty downgrade(), seed had duplicate
ingredient rows.

Migrations added: 0003 grocery_item.description, 0004 family_profile.
calorie_target, 0005 grocery_item.external_id + source + composite index.

Verified: 31/31 pytest green, alembic upgrade->downgrade->upgrade clean,
frontend npm run build clean, live scrape 9,960 grocery_item rows in 36s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/api/auth.py

@@ -0,0 +1,67 @@
+"""
+Family-shared session login.
+
+POST /api/auth/login — body ``{"password": "..."}`` — must match
+``settings.SESSION_PASSWORD``. On success: signs the first FamilyProfile.id
+and writes it as the ``mp_session`` cookie, returns 204.
+
+POST /api/auth/logout — clears the cookie, returns 204.
+
+The session is intentionally simple: a single shared family password gates
+mutations behind nginx on the trusted network. No per-user auth.
+"""
+
+from fastapi import APIRouter, Depends, HTTPException, Response, status
+from pydantic import BaseModel
+from sqlalchemy.orm import Session
+
+from app.config import settings
+from app.database import get_db
+from app.models import FamilyProfile
+from app.security import SESSION_COOKIE, SESSION_MAX_AGE, issue_session
+
+router = APIRouter()
+
+
+class LoginRequest(BaseModel):
+    password: str
+
+
+@router.post("/login")
+def login(payload: LoginRequest, db: Session = Depends(get_db)):
+    expected = settings.SESSION_PASSWORD
+    if not expected:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Session auth not configured",
+        )
+    if payload.password != expected:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid password"
+        )
+
+    profile = db.query(FamilyProfile).first()
+    # If no profile exists yet, sign a placeholder so the cookie still
+    # validates; the family-id will be re-issued the first time a profile
+    # is created. This avoids login being blocked on first-run.
+    family_id = str(profile.id) if profile else "bootstrap"
+    cookie_value = issue_session(family_id)
+
+    response = Response(status_code=status.HTTP_204_NO_CONTENT)
+    response.set_cookie(
+        key=SESSION_COOKIE,
+        value=cookie_value,
+        max_age=SESSION_MAX_AGE,
+        httponly=True,
+        secure=True,
+        samesite="lax",
+        path="/",
+    )
+    return response
+
+
+@router.post("/logout")
+def logout():
+    response = Response(status_code=status.HTTP_204_NO_CONTENT)
+    response.delete_cookie(key=SESSION_COOKIE, path="/")
+    return response