feat: AM-3..AM-6 strip SWIFTLY_BEARER_TOKEN env var, delete superseded script, refresh docs

AM-3: SWIFTLY_BEARER_TOKEN removed from .env.example, .env.test (local),
docker-compose.yml service env, and Settings (backend/app/config.py).
The scraper docstring is updated to reflect the auto-mint path.

AM-4: scripts/refresh_swiftly_token.py (commit ccfb38a, seleniumbase
click-through capture) deleted; superseded by swiftly_auth.py.

AM-5: docs refreshed.
- spec status header → "Implemented 2026-05-06" with live-verification
  evidence
- HANDOFF.md TL;DR + caveats #2/#3 collapsed; replaced with the
  auto-mint failure-modes caveat; "Suggested next move" rewritten
  pointing to Phase 5 orchestration; file-map and last-updated touched
- ORIENTATION.md env-var section updated (no bearer var) + footer

AM-6 verification gate (run 2026-05-06):
- pytest -q tests/ → 92/92 green (88 prior + 4 new swiftly_auth)
- POST /api/admin/scrape → status=success, items_scraped=10928 in 44s
- grocery_item rows: 9980 (after dedup-by external_id)
- ingredient_grocery_match rows: 29779 (matcher post-hook populated)
- Container env confirmed clean of SWIFTLY_BEARER_TOKEN

The system now scrapes, matches, and generates plans without any
operator-managed credential. Live JWT lifecycle: Firebase REST anon
signUp → cache for ~55min → re-mint as needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/ORIENTATION.md

@@ -95,10 +95,7 @@ SENDGRID_API_KEY=...              # only when EMAIL_BACKEND=sendgrid (R3-C)
 LUCKY_STORE_ID=757                 # Lucky California — San Pablo
 SWIFTLY_API_BASE=https://prod.swiftlyapi.net
 SWIFTLY_CATEGORIES_URL=https://luckysupermarkets.com/categories
-SWIFTLY_BEARER_TOKEN=...           # Firebase anon JWT, expires hourly
-                                   # → scheduled for removal: see
-                                   # docs/specs/2026-05-06-swiftly-token-auto-mint.md
-                                   # (auto-mint via Firebase REST, no manual capture)
+# (no bearer-token env var — minted on demand by app/services/swiftly_auth.py)
 
 # Other
 LUCKY_CA_URL=https://luckysupermarkets.com
@@ -106,7 +103,7 @@ AI_IMAGE_ENABLED=false
 LOG_LEVEL=INFO
 ```
 
-`.env.example` carries a literal expiring bearer token — rotate before any real run. On expiry, the next scrape's `ScrapeLog.error_message` reads `SWIFTLY_BEARER_TOKEN expired — request a fresh token from the user (capture from luckysupermarkets.com network tab on a /search/api/v1 request)`. Fix: capture a fresh `Authorization: Bearer …` from devtools, update env, restart backend, re-trigger.
+The Swiftly bearer JWT is auto-minted at request time via Firebase REST anon-signUp (`backend/app/services/swiftly_auth.py`, spec `docs/specs/2026-05-06-swiftly-token-auto-mint.md`). Process-local cache; ~99% cache-hit rate in steady state. A mint failure surfaces as `SwiftlyAuthMintError` and lands verbatim in `ScrapeLog.error_message`.
 
 ---
 
@@ -148,10 +145,10 @@ A `.env.test` template lives in the repo root (gitignored) for local stack runs.
 - `docs/implementation-plan.md` — original phased plan.
 - `docs/RUNNING.md` — local dev workflow.
 - `docs/specs/2026-05-05-meal-planner-algorithm-design.md` — Phase 9 + thin Phase 4 design.
-- `docs/specs/2026-05-06-swiftly-token-auto-mint.md` — next-up redesign that eliminates the only operator-toil step.
+- `docs/specs/2026-05-06-swiftly-token-auto-mint.md` — Swiftly JWT auto-mint design (Implemented 2026-05-06).
 - `.agent/plan.md`, `.agent/context.md`, `.agent/phase-summaries/` — recovery decisions and per-phase summaries from the R1+R2+R3-0 work.
 - `Review/reviewconcensus.md` — the adversarial review that drove the recovery.
 
 ---
 
-Last updated: 2026-05-06 — Phase 9 shipped (88/88 pytest green); Swiftly token auto-mint designed (`docs/specs/2026-05-06-swiftly-token-auto-mint.md`) and broken into AM-1..AM-6 in `docs/HANDOFF.md` for fresh-agent handoff.
+Last updated: 2026-05-06 — Swiftly auto-mint shipped (AM-1..AM-6); 92/92 pytest green; live scrape verified end-to-end with no `SWIFTLY_BEARER_TOKEN` env var. Next pickup: Phase 5 weekly orchestration.