feat: phase r1+r2 recovery + r3-0 swiftly api ingestion

R1 stabilization: pytest harness with transactional db fixture, smoke
+ alembic + auth + scrape + approval + swiftly tests, github actions
ci yaml. Bearer-token admin auth + signed-cookie session for family
ui mutations. Async POST /api/admin/scrape (BackgroundTasks, returns
202). Path canonicalization (no /list, /planned suffixes). DATABASE_URL
fail-fast on empty.

R2 deferred-risk spikes: live lucky california fetch (R2-A), full
email+per-voter approval click round trip with single-use enforcement
(R2-B, console email backend, sendgrid stub).

R3-0 phase 3 redesign: replaced playwright html scraper with requests
based swiftly json api client. 17 categories, ~10k products per scrape,
upsert by (source, external_id). 401 surfaces actionable token-refresh
message via ScrapeLog.error_message.

Pre-existing defects fixed: shopping_list.py syntax error blocking app
import, MealPlan.votes orphan relationship, JSONB(astext=True) invalid
kwarg, missing requests dep, calorie_target schema drift, every SQLEnum
needed values_callable, 0001 had empty downgrade(), seed had duplicate
ingredient rows.

Migrations added: 0003 grocery_item.description, 0004 family_profile.
calorie_target, 0005 grocery_item.external_id + source + composite index.

Verified: 31/31 pytest green, alembic upgrade->downgrade->upgrade clean,
frontend npm run build clean, live scrape 9,960 grocery_item rows in 36s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/api/index.ts

@@ -7,9 +7,15 @@ const api = axios.create({
   headers: {
     'Content-Type': 'application/json',
   },
+  withCredentials: true,
 })
 
 export const mealPlannerApi = {
+  auth: {
+    login: (password: string) => api.post('/auth/login', { password }),
+    logout: () => api.post('/auth/logout'),
+  },
+
   profile: {
     get: () => api.get('/profile'),
     update: (data: any) => api.put('/profile', data),
@@ -23,12 +29,12 @@ export const mealPlannerApi = {
     get: (id: string) => api.get(`/recipes/${id}`),
     create: (data: any) => api.post('/recipes', data),
     delete: (id: string) => api.delete(`/recipes/${id}`),
-    listIngredients: () => api.get('/recipes/ingredients/list'),
+    listIngredients: () => api.get('/recipes/ingredients'),
     createIngredient: (data: any) => api.post('/recipes/ingredients', data),
   },
 
   meals: {
-    getPlanned: () => api.get('/meals/planned'),
+    getPlanned: () => api.get('/meals'),
     get: (id: string) => api.get(`/meals/${id}`),
     getItem: (id: string) => api.get(`/meals/items/${id}`),
     create: (data: any) => api.post('/meals', data),