feat: cooking history/gallery, unit conversion, nutrition diary, pantry scan, digest cron, nutrition-targeted meal plans

Six M-sized items from HANDOFF.md's new-features backlog:

- Profile tabs: cooking-history stats (total cooked, last-cooked, streak)
  and a "cooked it" photo gallery, both owner-only
- Display-time unit conversion (metric<->imperial) for recipe ingredients,
  respecting each user's unitPref; original value always shown alongside
  the conversion
- Nutrition daily diary: per-day macro totals computed from cooking history
  x recipe nutritionData, compared against user goals
- Pantry scan: real barcode lookup (zxing + Open Food Facts, no API key)
  with an AI-vision fallback for unbarcoded items, always confirm-before-
  insert, both paths tier/rate-limited like other AI features
- Weekly digest email: new followers/comments/ratings + trending recipes,
  sent via a new `cron` Docker stage (alpine+crond+curl) and `digest-cron`
  compose service hitting a bearer-token-protected internal route
- Meal-plan generation can now target a user's nutrition goals as a
  prompt-level nudge (recipes are AI-invented, not DB-sourced, so this
  can't be a hard macro constraint)

Caught a real deploy-breaking issue while adding the cron stage: appending
it after `runner` silently changed the Dockerfile's default build target,
and `web`'s compose config didn't pin one — fixed by pinning `target:
runner` explicitly. Verified with typecheck, lint, and three separate
`docker build --target` runs (runner/cron/migrator) plus `docker compose
config` validation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker/compose.prod.yml

@@ -65,6 +65,10 @@ services:
     build:
       context: ..
       dockerfile: Dockerfile
+      # Explicit target: the Dockerfile's last stage is no longer `runner` now
+      # that `cron` was appended after it, and the default build target is
+      # whatever stage comes last — pin it so this doesn't silently change.
+      target: runner
       args:
         NEXT_PUBLIC_VAPID_PUBLIC_KEY: ${NEXT_PUBLIC_VAPID_PUBLIC_KEY}
         NEXT_PUBLIC_GITHUB_ENABLED: ${NEXT_PUBLIC_GITHUB_ENABLED}
@@ -102,6 +106,7 @@ services:
       SMTP_PASS: ${SMTP_PASS}
       SMTP_FROM: ${SMTP_FROM}
       STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}
+      CRON_SECRET: ${CRON_SECRET}
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
       OPENROUTER_DEFAULT_MODEL: ${OPENROUTER_DEFAULT_MODEL}
       OPENAI_API_KEY: ${OPENAI_API_KEY}
@@ -118,6 +123,21 @@ services:
       minio:
         condition: service_healthy
 
+  # Fires the weekly digest email send by POSTing to `web`'s internal cron
+  # route on a schedule (see docker/cron/crontab). Tiny alpine+curl+crond
+  # image — not part of the app build, just a periodic HTTP trigger.
+  digest-cron:
+    build:
+      context: ..
+      dockerfile: Dockerfile
+      target: cron
+    restart: always
+    environment:
+      CRON_SECRET: ${CRON_SECRET}
+      WEB_INTERNAL_URL: http://web:3000
+    depends_on:
+      - web
+
 volumes:
   postgres_data:
   redis_data:

docker/compose.yml

@@ -1,3 +1,7 @@
+# Dev-only infra: postgres/redis/minio. The app and the `digest-cron` container
+# (docker/compose.prod.yml) aren't run here — use `pnpm dev` locally, and hit
+# POST /api/internal/cron/weekly-digest with the CRON_SECRET header directly if
+# you need to test the weekly digest send without waiting for the schedule.
 services:
   postgres:
     image: postgres:17-alpine

docker/cron/crontab

@@ -0,0 +1,2 @@
+# Weekly digest — every Monday at 08:00 UTC.
+0 8 * * 1 /usr/local/bin/run-digest.sh >> /proc/1/fd/1 2>> /proc/1/fd/2

docker/cron/run-digest.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Triggers the weekly digest email send on the `web` service. Run on a schedule
+# by busybox crond (see docker/cron/crontab). Fails loudly (non-zero exit,
+# stderr) but crond just tries again next week — no retry loop here on purpose,
+# keep this script trivial.
+set -eu
+
+: "${WEB_INTERNAL_URL:=http://web:3000}"
+
+if [ -z "${CRON_SECRET:-}" ]; then
+  echo "run-digest: CRON_SECRET is not set, refusing to call the digest endpoint" >&2
+  exit 1
+fi
+
+curl -fsS -X POST \
+  -H "Authorization: Bearer ${CRON_SECRET}" \
+  "${WEB_INTERNAL_URL}/api/internal/cron/weekly-digest"