feat: phase r1+r2 recovery + r3-0 swiftly api ingestion

R1 stabilization: pytest harness with transactional db fixture, smoke
+ alembic + auth + scrape + approval + swiftly tests, github actions
ci yaml. Bearer-token admin auth + signed-cookie session for family
ui mutations. Async POST /api/admin/scrape (BackgroundTasks, returns
202). Path canonicalization (no /list, /planned suffixes). DATABASE_URL
fail-fast on empty.

R2 deferred-risk spikes: live lucky california fetch (R2-A), full
email+per-voter approval click round trip with single-use enforcement
(R2-B, console email backend, sendgrid stub).

R3-0 phase 3 redesign: replaced playwright html scraper with requests
based swiftly json api client. 17 categories, ~10k products per scrape,
upsert by (source, external_id). 401 surfaces actionable token-refresh
message via ScrapeLog.error_message.

Pre-existing defects fixed: shopping_list.py syntax error blocking app
import, MealPlan.votes orphan relationship, JSONB(astext=True) invalid
kwarg, missing requests dep, calorie_target schema drift, every SQLEnum
needed values_callable, 0001 had empty downgrade(), seed had duplicate
ingredient rows.

Migrations added: 0003 grocery_item.description, 0004 family_profile.
calorie_target, 0005 grocery_item.external_id + source + composite index.

Verified: 31/31 pytest green, alembic upgrade->downgrade->upgrade clean,
frontend npm run build clean, live scrape 9,960 grocery_item rows in 36s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/api/recipes.py

@@ -3,13 +3,14 @@ from sqlalchemy.orm import Session, joinedload
 from app.database import get_db
 from app.models import Recipe, FamilyProfile
 from app.schemas import RecipeResponse, RecipeCreate, IngredientCreate, IngredientResponse
+from app.security import require_session
 from uuid import UUID
 from typing import List, Optional
 
 router = APIRouter()
 
 
-@router.get("/", response_model=List[RecipeResponse])
+@router.get("", response_model=List[RecipeResponse])
 def get_recipes(
     skip: int = 0,
     limit: int = 50,
@@ -31,6 +32,37 @@ def get_recipes(
     return recipes
 
 
+@router.get("/ingredients", response_model=List[IngredientResponse])
+def list_ingredients(skip: int = 0, limit: int = 100, db: Session = Depends(get_db)):
+    from app.models import Ingredient
+    ingredients = db.query(Ingredient).offset(skip).limit(limit).all()
+    return ingredients
+
+
+@router.post("/ingredients", response_model=IngredientResponse, dependencies=[Depends(require_session)])
+def create_ingredient(ingredient: IngredientCreate, db: Session = Depends(get_db)):
+    from app.models import Ingredient
+
+    existing = db.query(Ingredient).filter(Ingredient.name_lower == ingredient.name_lower).first()
+    if existing:
+        raise HTTPException(status_code=400, detail="Ingredient with this name already exists")
+
+    db_ingredient = Ingredient(
+        name=ingredient.name,
+        name_lower=ingredient.name_lower,
+        plural_name=ingredient.plural_name,
+        aisle=ingredient.aisle,
+        typical_price=ingredient.typical_price,
+        unit=ingredient.unit,
+        season_months=ingredient.season_months
+    )
+
+    db.add(db_ingredient)
+    db.commit()
+    db.refresh(db_ingredient)
+    return db_ingredient
+
+
 @router.get("/{recipe_id}", response_model=RecipeResponse)
 def get_recipe(recipe_id: UUID, db: Session = Depends(get_db)):
     recipe = db.query(Recipe).filter(Recipe.id == recipe_id).first()
@@ -39,7 +71,7 @@ def get_recipe(recipe_id: UUID, db: Session = Depends(get_db)):
     return recipe
 
 
-@router.post("/", response_model=RecipeResponse)
+@router.post("", response_model=RecipeResponse, dependencies=[Depends(require_session)])
 def create_recipe(recipe: RecipeCreate, db: Session = Depends(get_db)):
     profile = db.query(FamilyProfile).first()
 
@@ -69,7 +101,7 @@ def create_recipe(recipe: RecipeCreate, db: Session = Depends(get_db)):
     return db_recipe
 
 
-@router.delete("/{recipe_id}")
+@router.delete("/{recipe_id}", dependencies=[Depends(require_session)])
 def delete_recipe(recipe_id: UUID, db: Session = Depends(get_db)):
     recipe = db.query(Recipe).filter(Recipe.id == recipe_id).first()
     if not recipe:
@@ -78,34 +110,3 @@ def delete_recipe(recipe_id: UUID, db: Session = Depends(get_db)):
     db.delete(recipe)
     db.commit()
     return {"message": "Recipe deleted"}
-
-
-@router.get("/ingredients/list", response_model=List[IngredientResponse])
-def list_ingredients(skip: int = 0, limit: int = 100, db: Session = Depends(get_db)):
-    from app.models import Ingredient
-    ingredients = db.query(Ingredient).offset(skip).limit(limit).all()
-    return ingredients
-
-
-@router.post("/ingredients", response_model=IngredientResponse)
-def create_ingredient(ingredient: IngredientCreate, db: Session = Depends(get_db)):
-    from app.models import Ingredient
-
-    existing = db.query(Ingredient).filter(Ingredient.name_lower == ingredient.name_lower).first()
-    if existing:
-        raise HTTPException(status_code=400, detail="Ingredient with this name already exists")
-
-    db_ingredient = Ingredient(
-        name=ingredient.name,
-        name_lower=ingredient.name_lower,
-        plural_name=ingredient.plural_name,
-        aisle=ingredient.aisle,
-        typical_price=ingredient.typical_price,
-        unit=ingredient.unit,
-        season_months=ingredient.season_months
-    )
-
-    db.add(db_ingredient)
-    db.commit()
-    db.refresh(db_ingredient)
-    return db_ingredient