TICKET-006 (frontend): barcode scanner, OFF scan/search flows, recent foods

- lib/scanner.js: native BarcodeDetector + lazy zxing-wasm fallback, ~4fps
  decode loop, camera teardown in stop() (§8.2 rule 6)
- BarcodeScanner.svelte: getUserMedia camera, permission-denied → message +
  manual barcode text input fallback, stop on first detect + on destroy
- App.svelte: §4.1 scan-flow state machine (localFound/offFound/notFound/
  error) — local-by-barcode first, OFF lookup → pre-fill FoodEditor → save
  → log, Refresh-from-OFF button, not-found → manual/search options
- FoodEditor.svelte: optional food prop pre-fills from OFF (read-only
  barcode, source badge), post-save log flow
- FoodSearch.svelte: OFF fallback (§4.2) when local results empty
- Dashboard.svelte: recent foods quick-log chips
- api.js: searchFoodsByBarcode, offRefresh, updateFood, recentFoods
- scanner.test.js: 2 unit tests for pure helpers
- §8.4 phone checklist deferred to user testing over Caddy HTTPS;
  manual-barcode + OFF search flows playwright-verified
- HANDOFF.md updated: M1+M2 complete, 007 next

frontend/src/lib/api.js

@@ -28,9 +28,11 @@ export const api = {
   health: () => request('/api/health'),
   // Foods (spec §3.1)
   searchFoods: (q) => request(`/api/foods?q=${encodeURIComponent(q)}`),
+  searchFoodsByBarcode: (barcode) => request(`/api/foods?barcode=${encodeURIComponent(barcode)}`),
   recentFoods: (limit = 10) => request(`/api/foods/recent?limit=${limit}`),
   getFood: (id) => request(`/api/foods/${id}`),
   createFood: (food) => request('/api/foods', { method: 'POST', body: JSON.stringify(food) }),
+  updateFood: (id, food) => request(`/api/foods/${id}`, { method: 'PUT', body: JSON.stringify(food) }),
   // Daily log (spec §3.3) — dates are YYYY-MM-DD strings end-to-end (spec §8.3 rule 4)
   getLog: (date) => request(`/api/log?date=${date}`),
   addLogEntry: (entry) => request('/api/log', { method: 'POST', body: JSON.stringify(entry) }),
@@ -44,4 +46,5 @@ export const api = {
   // OFF proxy (spec §3.5) — the frontend never calls OFF directly
   offProduct: (barcode) => request(`/api/off/product/${barcode}`),
   offSearch: (q) => request(`/api/off/search?q=${encodeURIComponent(q)}`),
+  offRefresh: (foodId) => request(`/api/off/refresh/${foodId}`, { method: 'POST' }),
 }