feat: AM-3..AM-6 strip SWIFTLY_BEARER_TOKEN env var, delete superseded script, refresh docs

AM-3: SWIFTLY_BEARER_TOKEN removed from .env.example, .env.test (local),
docker-compose.yml service env, and Settings (backend/app/config.py).
The scraper docstring is updated to reflect the auto-mint path.

AM-4: scripts/refresh_swiftly_token.py (commit ccfb38a, seleniumbase
click-through capture) deleted; superseded by swiftly_auth.py.

AM-5: docs refreshed.
- spec status header → "Implemented 2026-05-06" with live-verification
  evidence
- HANDOFF.md TL;DR + caveats #2/#3 collapsed; replaced with the
  auto-mint failure-modes caveat; "Suggested next move" rewritten
  pointing to Phase 5 orchestration; file-map and last-updated touched
- ORIENTATION.md env-var section updated (no bearer var) + footer

AM-6 verification gate (run 2026-05-06):
- pytest -q tests/ → 92/92 green (88 prior + 4 new swiftly_auth)
- POST /api/admin/scrape → status=success, items_scraped=10928 in 44s
- grocery_item rows: 9980 (after dedup-by external_id)
- ingredient_grocery_match rows: 29779 (matcher post-hook populated)
- Container env confirmed clean of SWIFTLY_BEARER_TOKEN

The system now scrapes, matches, and generates plans without any
operator-managed credential. Live JWT lifecycle: Firebase REST anon
signUp → cache for ~55min → re-mint as needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/config.py

@@ -10,8 +10,8 @@ class Settings(BaseSettings):
     SENDGRID_API_KEY: Optional[str] = None
     EMAIL_BACKEND: str = "console"
     LUCKY_CA_URL: str = "https://www.luckyncal.com"
-    # R3-0: Swiftly product API (replaces Playwright path).
-    SWIFTLY_BEARER_TOKEN: str = ""
+    # Swiftly product API (replaces Playwright path). The bearer JWT is
+    # auto-minted at request time via app.services.swiftly_auth.get_token().
     LUCKY_STORE_ID: str = "757"
     SWIFTLY_API_BASE: str = "https://prod.swiftlyapi.net"
     SWIFTLY_CATEGORIES_URL: str = "https://luckysupermarkets.com/categories"

backend/app/scraper/lucky_ca_scraper.py

@@ -15,12 +15,14 @@ on luckysupermarkets.com — see ``.agent/context.md`` "Swiftly API"):
 
   GET https://prod.swiftlyapi.net/search/api/v1/products/categories
       ?cat=<slug>&store=<store_id>&limit=10000
-      Authorization: Bearer <SWIFTLY_BEARER_TOKEN>
+      Authorization: Bearer <jwt>
       → ``{"products": {"info": {...}, "items": [...], "facets": [...]}}``
 
-The bearer token expires roughly hourly. On 401 we raise
-``SwiftlyAuthError`` so the background runner records the error_message
-that asks the admin to refresh ``SWIFTLY_BEARER_TOKEN`` and retry.
+The bearer JWT is minted on demand via ``swiftly_auth.get_token()``
+(Firebase REST anon-signUp; cached for ~55min/hour). On 401 — which
+should not happen with a freshly minted token — we raise
+``SwiftlyAuthError`` so the background runner records an error_message
+pointing at the auto-mint spec.
 """
 from __future__ import annotations