feat: cocktails list with load and download buttons

[devin-ai-integration]

Summary

Adds the feature requested in the session: a button on the main page that downloads a list of cocktails from thecocktaildb, plus the cocktail names and ingredients rendered on the page.

Implementation:

• Backend proxy — GET /api/cocktails?letter={a-z} (src/routes/cocktails.js). Calls search.php?f={letter} on thecocktaildb, flattens the 15 strIngredient{n}/strMeasure{n} fields into a clean ingredients: [{ name, measure }] array, and returns [{ id, name, category, glass, thumbnail, ingredients }]. Results cached in-memory per letter for 10 min. Invalid letter → 400; upstream non-OK → 502.
• Static UI — public/index.html served at / via express.static. Contains an input for the initial letter, a "Cargar cócteles" button that fetches /api/cocktails?letter=… and renders each cocktail as a card with name + ingredient list, and a "Descargar JSON" button that saves the fetched list as cocktails-{letter}.json via a client-side Blob download.
• Routing change — API metadata moved from GET / → GET /api, so / can serve the HTML. /health is unchanged.
• Tests — 6 new tests for /api/cocktails (happy path with ingredient parsing, null drinks, default letter, invalid letter, upstream 5xx, and cache hit) with fetch stubbed via vi.stubGlobal. root.test.js updated to match the new routing (/api metadata, / serves HTML). All 10 tests pass locally along with npm run lint and npm run format:check.
• README — endpoints table, example JSON response, and project layout updated.

Review & Testing Checklist for Human

• End-to-end with the real upstream (tests only cover mocked fetch): npm install && npm run dev, open http://localhost:3000, try letters a, m, z, and a letter with no results, plus the "Descargar JSON" button. Confirm names + ingredients render correctly and the downloaded file contains the same data.
• Confirm the routing change is acceptable: GET / now returns HTML (previously JSON metadata); JSON metadata moved to GET /api. If any external caller depended on GET / returning JSON, it will break.
• Decide whether the in-memory 10-minute per-letter cache is desired, or whether requests should always hit thecocktaildb (no cache invalidation endpoint exists).

Notes

• express.static(publicDir) is mounted before API routes. If a file under public/ ever collides with an API path (e.g. a file named api), it would shadow the route — not a concern today, but worth keeping in mind.
• No rate limiting or API key handling for the upstream proxy (thecocktaildb's free key 1 is hardcoded, which is how their public docs instruct). Fine for a sandbox; add a limiter before exposing publicly.
• parseDrink reads strIngredient1..15 per thecocktaildb's current schema; extra fields added upstream in the future would be silently ignored.

Link to Devin session: https://app.devin.ai/sessions/38829c1a13124d54a5fdf114ce348ba9
Requested by: @ModulosPB

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.