feat: implement Iteration 1 — AI recipe recommendations

Backend:
- Add Groq LLM client (llama-3.3-70b) for recipe generation with JSON
  retry strategy (retries only on parse errors, not API errors)
- Add Pexels client for parallel photo search per recipe
- Add saved_recipes table (migration 004) with JSONB fields
- Add GET /recommendations endpoint (profile-aware prompt building)
- Add POST/GET/GET{id}/DELETE /saved-recipes CRUD endpoints
- Wire gemini, pexels, recommendation, savedrecipe packages in main.go

Flutter:
- Add Recipe, SavedRecipe models with json_serializable
- Add RecipeService (getRecommendations, getSavedRecipes, save, delete)
- Add RecommendationsNotifier and SavedRecipesNotifier (Riverpod)
- Add RecommendationsScreen with skeleton loading and refresh FAB
- Add RecipeDetailScreen (SliverAppBar, nutrition tooltip, steps with timer)
- Add SavedRecipesScreen with Dismissible swipe-to-delete and empty state
- Update RecipesScreen to TabBar (Recommendations / Saved)
- Add /recipe-detail route outside ShellRoute (no bottom nav)
- Extend ApiClient with getList() and deleteVoid()

Project:
- Add CLAUDE.md with English-only rule for comments and commit messages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/savedrecipe/handler.go

@@ -0,0 +1,135 @@
+package savedrecipe
+
+import (
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+
+	"github.com/food-ai/backend/internal/middleware"
+	"github.com/go-chi/chi/v5"
+)
+
+const maxBodySize = 1 << 20 // 1 MB
+
+// Handler handles HTTP requests for saved recipes.
+type Handler struct {
+	repo *Repository
+}
+
+// NewHandler creates a new Handler.
+func NewHandler(repo *Repository) *Handler {
+	return &Handler{repo: repo}
+}
+
+// Save handles POST /saved-recipes.
+func (h *Handler) Save(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.UserIDFromCtx(r.Context())
+	if userID == "" {
+		writeErrorJSON(w, http.StatusUnauthorized, "unauthorized")
+		return
+	}
+
+	r.Body = http.MaxBytesReader(w, r.Body, maxBodySize)
+	var req SaveRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeErrorJSON(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+	if req.Title == "" {
+		writeErrorJSON(w, http.StatusBadRequest, "title is required")
+		return
+	}
+
+	rec, err := h.repo.Save(r.Context(), userID, req)
+	if err != nil {
+		slog.Error("save recipe", "err", err)
+		writeErrorJSON(w, http.StatusInternalServerError, "failed to save recipe")
+		return
+	}
+	writeJSON(w, http.StatusCreated, rec)
+}
+
+// List handles GET /saved-recipes.
+func (h *Handler) List(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.UserIDFromCtx(r.Context())
+	if userID == "" {
+		writeErrorJSON(w, http.StatusUnauthorized, "unauthorized")
+		return
+	}
+
+	recipes, err := h.repo.List(r.Context(), userID)
+	if err != nil {
+		slog.Error("list saved recipes", "err", err)
+		writeErrorJSON(w, http.StatusInternalServerError, "failed to list saved recipes")
+		return
+	}
+
+	if recipes == nil {
+		recipes = []*SavedRecipe{}
+	}
+	writeJSON(w, http.StatusOK, recipes)
+}
+
+// GetByID handles GET /saved-recipes/{id}.
+func (h *Handler) GetByID(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.UserIDFromCtx(r.Context())
+	if userID == "" {
+		writeErrorJSON(w, http.StatusUnauthorized, "unauthorized")
+		return
+	}
+
+	id := chi.URLParam(r, "id")
+	rec, err := h.repo.GetByID(r.Context(), userID, id)
+	if err != nil {
+		slog.Error("get saved recipe", "id", id, "err", err)
+		writeErrorJSON(w, http.StatusInternalServerError, "failed to get saved recipe")
+		return
+	}
+	if rec == nil {
+		writeErrorJSON(w, http.StatusNotFound, "recipe not found")
+		return
+	}
+	writeJSON(w, http.StatusOK, rec)
+}
+
+// Delete handles DELETE /saved-recipes/{id}.
+func (h *Handler) Delete(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.UserIDFromCtx(r.Context())
+	if userID == "" {
+		writeErrorJSON(w, http.StatusUnauthorized, "unauthorized")
+		return
+	}
+
+	id := chi.URLParam(r, "id")
+	if err := h.repo.Delete(r.Context(), userID, id); err != nil {
+		if errors.Is(err, ErrNotFound) {
+			writeErrorJSON(w, http.StatusNotFound, "recipe not found")
+			return
+		}
+		slog.Error("delete saved recipe", "id", id, "err", err)
+		writeErrorJSON(w, http.StatusInternalServerError, "failed to delete recipe")
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+type errorResponse struct {
+	Error string `json:"error"`
+}
+
+func writeErrorJSON(w http.ResponseWriter, status int, msg string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(errorResponse{Error: msg}); err != nil {
+		slog.Error("write error response", "err", err)
+	}
+}
+
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(v); err != nil {
+		slog.Error("write JSON response", "err", err)
+	}
+}