docs: design Swiftly token auto-mint and queue it as next implementation pass

Discovery: luckysupermarkets.com/config.json is publicly readable and
exposes firebaseApiKey. With proper Origin/Referer headers, Firebase
Identity Toolkit's anonymous-signup REST endpoint mints the same JWT
shape (iss=swiftly-lu-prod, aud=swiftly-lu-prod, anon provider, 3600s
TTL) that Swiftly accepts. Verified end-to-end on 2026-05-06.

This eliminates the manual hourly token-capture toil and supersedes
the seleniumbase-based scripts/refresh_swiftly_token.py (commit
ccfb38a) which had partial UI selector issues.

- New spec: docs/specs/2026-05-06-swiftly-token-auto-mint.md
- HANDOFF.md TL;DR refreshed (Phase 9 shipped); caveat #2 + #3
  rewritten to point to the auto-mint redesign; suggested-next-move
  reordered to put the redesign first
- ORIENTATION.md env-var section flags SWIFTLY_BEARER_TOKEN as
  scheduled-for-removal; "Where to look" lists both specs;
  last-updated footer refreshed

Implementation deferred — this commit captures the design and routing
only. Estimated 2-3 hours of focused work to ship per the spec.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/ORIENTATION.md

@@ -96,6 +96,9 @@ LUCKY_STORE_ID=757                 # Lucky California — San Pablo
 SWIFTLY_API_BASE=https://prod.swiftlyapi.net
 SWIFTLY_CATEGORIES_URL=https://luckysupermarkets.com/categories
 SWIFTLY_BEARER_TOKEN=...           # Firebase anon JWT, expires hourly
+                                   # → scheduled for removal: see
+                                   # docs/specs/2026-05-06-swiftly-token-auto-mint.md
+                                   # (auto-mint via Firebase REST, no manual capture)
 
 # Other
 LUCKY_CA_URL=https://luckysupermarkets.com
@@ -144,9 +147,11 @@ A `.env.test` template lives in the repo root (gitignored) for local stack runs.
 - `docs/database-schema.md` — full DDL reference.
 - `docs/implementation-plan.md` — original phased plan.
 - `docs/RUNNING.md` — local dev workflow.
+- `docs/specs/2026-05-05-meal-planner-algorithm-design.md` — Phase 9 + thin Phase 4 design.
+- `docs/specs/2026-05-06-swiftly-token-auto-mint.md` — next-up redesign that eliminates the only operator-toil step.
 - `.agent/plan.md`, `.agent/context.md`, `.agent/phase-summaries/` — recovery decisions and per-phase summaries from the R1+R2+R3-0 work.
 - `Review/reviewconcensus.md` — the adversarial review that drove the recovery.
 
 ---
 
-Last updated: 2026-05-06 — Phase 9 complete (meal-plan generation algorithm: filter→score→set-select pipeline; persisted MealPlan + items via POST /api/admin/meal-plans/generate). 88/88 pytest green.
+Last updated: 2026-05-06 — Phase 9 shipped (88/88 pytest green); Swiftly token auto-mint designed (`docs/specs/2026-05-06-swiftly-token-auto-mint.md`) and queued as the next implementation pass.