feat: implement Iteration 2 — product management

Backend:
- migrations/005: add pg_trgm extension + search indexes on ingredient_mappings
- migrations/006: products table with computed expires_at column
- ingredient: add Search method (aliases + ILIKE + trgm) + HTTP handler
- product: full package — model, repository (CRUD + BatchCreate + ListForPrompt), handler
- gemini: add AvailableProducts field to RecipeRequest, include in prompt
- recommendation: add ProductLister interface, load user products for personalised prompts
- server/main: wire ingredient and product handlers with new routes

Flutter:
- models: Product, IngredientMapping with json_serializable
- ProductService: getProducts, createProduct, updateProduct, deleteProduct, searchIngredients
- ProductsNotifier: create/update/delete with optimistic delete
- ProductsScreen: expiring-soon section, normal section, swipe-to-delete, edit bottom sheet
- AddProductScreen: name field with 300ms debounce autocomplete, qty/unit/days fields
- app_router: /products/add route + Badge on Products nav tab showing expiring count
- MainShell converted to ConsumerWidget for badge reactivity

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/server/server.go

@@ -5,7 +5,9 @@ import (
 	"net/http"
 
 	"github.com/food-ai/backend/internal/auth"
+	"github.com/food-ai/backend/internal/ingredient"
 	"github.com/food-ai/backend/internal/middleware"
+	"github.com/food-ai/backend/internal/product"
 	"github.com/food-ai/backend/internal/recommendation"
 	"github.com/food-ai/backend/internal/savedrecipe"
 	"github.com/food-ai/backend/internal/user"
@@ -19,6 +21,8 @@ func NewRouter(
 	userHandler *user.Handler,
 	recommendationHandler *recommendation.Handler,
 	savedRecipeHandler *savedrecipe.Handler,
+	ingredientHandler *ingredient.Handler,
+	productHandler *product.Handler,
 	authMiddleware func(http.Handler) http.Handler,
 	allowedOrigins []string,
 ) *chi.Mux {
@@ -38,6 +42,12 @@ func NewRouter(
 		r.Post("/logout", authHandler.Logout)
 	})
 
+	// Public search (still requires auth to prevent scraping)
+	r.Group(func(r chi.Router) {
+		r.Use(authMiddleware)
+		r.Get("/ingredients/search", ingredientHandler.Search)
+	})
+
 	// Protected
 	r.Group(func(r chi.Router) {
 		r.Use(authMiddleware)
@@ -53,6 +63,14 @@ func NewRouter(
 			r.Get("/{id}", savedRecipeHandler.GetByID)
 			r.Delete("/{id}", savedRecipeHandler.Delete)
 		})
+
+		r.Route("/products", func(r chi.Router) {
+			r.Get("/", productHandler.List)
+			r.Post("/", productHandler.Create)
+			r.Post("/batch", productHandler.BatchCreate)
+			r.Put("/{id}", productHandler.Update)
+			r.Delete("/{id}", productHandler.Delete)
+		})
 	})
 
 	return r