feat: cooking history/gallery, unit conversion, nutrition diary, pantry scan, digest cron, nutrition-targeted meal plans

Six M-sized items from HANDOFF.md's new-features backlog:

- Profile tabs: cooking-history stats (total cooked, last-cooked, streak)
  and a "cooked it" photo gallery, both owner-only
- Display-time unit conversion (metric<->imperial) for recipe ingredients,
  respecting each user's unitPref; original value always shown alongside
  the conversion
- Nutrition daily diary: per-day macro totals computed from cooking history
  x recipe nutritionData, compared against user goals
- Pantry scan: real barcode lookup (zxing + Open Food Facts, no API key)
  with an AI-vision fallback for unbarcoded items, always confirm-before-
  insert, both paths tier/rate-limited like other AI features
- Weekly digest email: new followers/comments/ratings + trending recipes,
  sent via a new `cron` Docker stage (alpine+crond+curl) and `digest-cron`
  compose service hitting a bearer-token-protected internal route
- Meal-plan generation can now target a user's nutrition goals as a
  prompt-level nudge (recipes are AI-invented, not DB-sourced, so this
  can't be a hard macro constraint)

Caught a real deploy-breaking issue while adding the cron stage: appending
it after `runner` silently changed the Dockerfile's default build target,
and `web`'s compose config didn't pin one — fixed by pinning `target:
runner` explicitly. Verified with typecheck, lint, and three separate
`docker build --target` runs (runner/cron/migrator) plus `docker compose
config` validation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/pantry/scan/barcode/route.ts

@@ -0,0 +1,81 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
+
+const Schema = z.object({
+  barcode: z.string().trim().min(4).max(32).regex(/^[0-9]+$/, "Barcode must be numeric"),
+});
+
+type OffProduct = {
+  product_name?: string;
+  product_name_en?: string;
+  generic_name?: string;
+  quantity?: string;
+  product_quantity?: string;
+  product_quantity_unit?: string;
+  brands?: string;
+};
+
+type OffResponse = {
+  status: number;
+  product?: OffProduct;
+};
+
+/** Very rough unit guess from Open Food Facts' free-text `quantity` field (e.g. "500 g", "1 L"). */
+function extractUnit(quantity: string | undefined): string | undefined {
+  if (!quantity) return undefined;
+  const match = /([a-zA-Z]+)\s*$/.exec(quantity.trim());
+  return match?.[1]?.toLowerCase();
+}
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
+
+  const limited = await applyRateLimit(`rl:pantry-scan-barcode:${session!.user.id}`, 20, 60);
+  if (limited) return limited;
+
+  const { barcode } = parsed.data;
+
+  let offResponse: Response;
+  try {
+    offResponse = await fetch(
+      `https://world.openfoodfacts.org/api/v2/product/${encodeURIComponent(barcode)}.json`,
+      {
+        headers: { "User-Agent": "Epicure/1.0 (pantry-scan)" },
+        signal: AbortSignal.timeout(8000),
+      }
+    );
+  } catch {
+    return NextResponse.json({ error: "Barcode lookup service unavailable" }, { status: 502 });
+  }
+
+  if (!offResponse.ok) {
+    return NextResponse.json({ error: "Barcode lookup service unavailable" }, { status: 502 });
+  }
+
+  const data = await offResponse.json() as OffResponse;
+
+  if (data.status !== 1 || !data.product) {
+    return NextResponse.json({ found: false });
+  }
+
+  const product = data.product;
+  const rawName = product.product_name_en?.trim() || product.product_name?.trim() || product.generic_name?.trim();
+
+  if (!rawName) {
+    return NextResponse.json({ found: false });
+  }
+
+  return NextResponse.json({
+    found: true,
+    rawName: product.brands ? `${rawName} (${product.brands.split(",")[0]?.trim()})` : rawName,
+    quantity: product.product_quantity,
+    unit: extractUnit(product.product_quantity_unit) ?? extractUnit(product.quantity),
+  });
+}