feat: batch-cook shopping list (already worked) + leftover expiry reminders

Shopping list add already worked generically for batch-cook recipes —
no code needed there.

New: mark a specific batch-cook dish as "cooked today", track its
fridge expiry (cookingHistory.batchDishId), surface a "Leftovers
expiring soon" widget on the pantry page, and send a daily push+email
reminder via a new /api/internal/cron/leftover-reminders endpoint
(mirrors the weekly-digest cron pattern; doesn't use the social
notifications table, which requires a non-null actor and isn't built
for self-reminders).

Also fixes, from user-reported bugs:
- Recipe cards showed no batch-cook badge/dish-count/prep-time in some
  views — added dishCount + prepMins/cookMins (now generated by the AI
  and persisted) to the card component and /recipes query.
- Batch-cook descriptions occasionally contained raw markdown
  (**bold**) — added explicit "plain prose only" prompt instructions
  and a stripMarkdown() defensive fallback at render time.
- Truncated/cut-off descriptions — the generateObject call had no
  maxOutputTokens set, so long structured responses could get cut off
  mid-field; now capped explicitly at 8000.
- Generate dialogs (batch-cook + the main AI dialog) could show
  buttons unreachable once the progress bar appeared mid-generation —
  restructured so the action row is pinned outside the scrollable
  content area, not affected by content height changes.
- /api/internal/* routes were being redirected to /login by middleware
  before their own CRON_SECRET check ever ran (pre-existing bug,
  affected the weekly-digest cron too) — added to PUBLIC_PATHS.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cron/crontab

@@ -1,2 +1,5 @@
 # Weekly digest — every Monday at 08:00 UTC.
 0 8 * * 1 /usr/local/bin/run-digest.sh >> /proc/1/fd/1 2>> /proc/1/fd/2
+
+# Leftover-expiry reminders — daily at 09:00 UTC.
+0 9 * * * /usr/local/bin/run-leftover-reminders.sh >> /proc/1/fd/1 2>> /proc/1/fd/2

cron/run-leftover-reminders.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Triggers the leftover-expiry reminder send on the `web` service. Run on a
+# schedule by busybox crond (see cron/crontab). Fails loudly (non-zero exit,
+# stderr) but crond just tries again tomorrow — no retry loop here on purpose,
+# keep this script trivial.
+set -eu
+
+: "${WEB_INTERNAL_URL:=http://web:3000}"
+
+if [ -z "${CRON_SECRET:-}" ]; then
+  echo "run-leftover-reminders: CRON_SECRET is not set, refusing to call the endpoint" >&2
+  exit 1
+fi
+
+curl -fsS -X POST \
+  -H "Authorization: Bearer ${CRON_SECRET}" \
+  "${WEB_INTERNAL_URL}/api/internal/cron/leftover-reminders"