feat: migrate shopping list to new format with checked state

[dubadub]

Summary

• Rewrite ShoppingListStore to use the new .shopping-list format (cooklang-rs parser) instead of the old tab-delimited .shopping_list.txt
• Add .shopping-checked file for server-side persistent ingredient check state, replacing localStorage
• Auto-migrate from legacy format on first load (old file renamed to .bak)
• Add API endpoints: POST /check, POST /uncheck, GET /checked, POST /compact
• Compact checked log automatically on recipe removal to prune stale entries

Depends on: cooklang/cooklang-rs#(the checked file support PR)

Test plan

• Start server with existing .shopping_list.txt — verify auto-migration creates .shopping-list and renames old file
• Add/remove recipes via UI — verify .shopping-list file updates correctly
• Check/uncheck ingredients — verify .shopping-checked file receives + name/- name entries
• Reload page — verify checked state persists from server (not localStorage)
• Remove a recipe — verify .shopping-checked is compacted (stale entries removed)
• Clear list — verify both files are cleaned up

[claude]

Code Review

Overall this is a solid and well-thought-out migration. The design decisions (append-only checked log, atomic compact via rename, in-process mutex over file locks) are well documented and correct. A few things worth addressing:

---

Bug: to_multiplier duplicated in migrate_if_needed

shopping_list_store.rs defines to_multiplier(scale: f64) but migrate_if_needed re-implements the same logic inline:

let multiplier = if (scale - 1.0).abs() < f64::EPSILON {
    None
} else {
    Some(scale)
};

This should just be to_multiplier(scale). If the epsilon threshold ever changes, only one place gets updated.

---

Bug: clearList no longer resets in-memory checkedItems

The old code wrapped clearList to also clear localStorage and the in-memory set. The new code removes that wrapper. While a subsequent loadShoppingList() call will repopulate checkedItems from the (now empty) server response, any checked checkboxes currently visible on screen won't have their visual state reset until the list reloads. If clearList calls loadShoppingList() immediately after clearing (verify this), the issue resolves itself — but it's fragile. It would be safer to explicitly checkedItems.clear() at the top of clearList.

---

Minor: Menu detection by file extension is brittle

api_items_from_list uses r.path.ends_with(".menu") to distinguish plan entries from recipe entries. This works as long as the .menu extension is the only convention, but since this is also how the format writer determines nesting structure, consider whether a future format version could break this. Not blocking, just worth a comment.

---

Minor: migrate_if_needed called on every mutation

load(), add(), add_menu(), and remove() each call migrate_if_needed() which does a fs::metadata stat on .shopping_list.txt and .shopping-list on every invocation. For a local tool this is fine, but once migration completes (the legacy file is renamed to .bak), the stat is a no-op forever. A lightweight flag or a check like !self.legacy_path.exists() short-circuits quickly — but this is acceptable as-is.

---

Good additions worth calling out

• escHtml + encodeRecipePath: The old template was vulnerable to XSS from recipe filenames containing <, >, ", ', and URL-breaking characters. All dynamic interpolations are now escaped. Nice.
• Event delegation over inline onclick: onclick="removeRecipe('${path}')" with unescaped paths was a latent script-injection risk. The data-action pattern is the right fix.
• Atomic compact via rename: Writing to a temp file, fsync-ing, then renaming is exactly right. The crash-safety comment is appreciated.
• checked_log_lock comment: The explanation of why flock is insufficient for same-process serialization is correct and saves the next reader from rediscovering it.
• Per-entry seen reset in aggregate_current_ingredient_names: The comment explaining why seen must be reset per top-level entry (duplicate entries from legacy format) is a good catch.

---

Nit: resolve_recipe_references is single-use

resolve_recipe_references is only called from add_menu_to_shopping_list. Since it's not reused and is short, consider inlining it or at least moving it immediately above its caller so the reader doesn't have to scroll.

---

Test plan gap

The manual test plan doesn't cover: what happens when .shopping-list is present but the cooklang parser returns an error (e.g. malformed file). load_list would propagate the error up through load() and surface as a 500. Worth verifying the UX for this case.