feat: cooking history/gallery, unit conversion, nutrition diary, pantry scan, digest cron, nutrition-targeted meal plans

Six M-sized items from HANDOFF.md's new-features backlog:

- Profile tabs: cooking-history stats (total cooked, last-cooked, streak)
  and a "cooked it" photo gallery, both owner-only
- Display-time unit conversion (metric<->imperial) for recipe ingredients,
  respecting each user's unitPref; original value always shown alongside
  the conversion
- Nutrition daily diary: per-day macro totals computed from cooking history
  x recipe nutritionData, compared against user goals
- Pantry scan: real barcode lookup (zxing + Open Food Facts, no API key)
  with an AI-vision fallback for unbarcoded items, always confirm-before-
  insert, both paths tier/rate-limited like other AI features
- Weekly digest email: new followers/comments/ratings + trending recipes,
  sent via a new `cron` Docker stage (alpine+crond+curl) and `digest-cron`
  compose service hitting a bearer-token-protected internal route
- Meal-plan generation can now target a user's nutrition goals as a
  prompt-level nudge (recipes are AI-invented, not DB-sourced, so this
  can't be a hard macro constraint)

Caught a real deploy-breaking issue while adding the cron stage: appending
it after `runner` silently changed the Dockerfile's default build target,
and `web`'s compose config didn't pin one — fixed by pinning `target:
runner` explicitly. Verified with typecheck, lint, and three separate
`docker build --target` runs (runner/cron/migrator) plus `docker compose
config` validation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/pantry/scan/photo/route.ts

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
+import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
+import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
+import { scanPantryPhoto } from "@/lib/ai/features/scan-pantry-photo";
+
+const Schema = z.object({
+  imageBase64: z.string().max(14_000_000),
+  mimeType: z.enum(["image/jpeg", "image/png", "image/webp"]),
+});
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
+  }
+
+  const userId = session!.user.id;
+
+  const limited = await applyRateLimit(`rl:ai:${userId}`, 10, 60);
+  if (limited) return limited;
+
+  const configResult = await resolveAiConfigOrError(() => getModelConfigForUseCase(userId, "vision"));
+  if (!configResult.ok) return configResult.response;
+  const aiConfig = configResult.data;
+
+  // Fall back to vision-capable defaults if no explicit model configured
+  if (!aiConfig.model) {
+    if (aiConfig.provider === "openai") aiConfig.model = "gpt-4o";
+    else if (aiConfig.provider === "anthropic") aiConfig.model = "claude-sonnet-4-6";
+  }
+
+  const result = await withAiQuota(userId, session!.user.tier as "free" | "pro", () =>
+    scanPantryPhoto(parsed.data.imageBase64, parsed.data.mimeType, aiConfig)
+  );
+  if (!result.ok) return result.response;
+
+  return NextResponse.json(result.data);
+}