Accept grocery receipts scanned in pantry as candidate spend

Adds /api/receipts/ingest as a sibling to the order lane, sharing its shape but
making one decision differently: nothing is parked. An order can wait for its
statement because it is already visible as an email; a gift-card grocery shop is
visible nowhere at all, so a scan that produces no transaction produces nothing
anyone can see. Every payment becomes a manual row immediately and the existing
pending-reconciliation queue resolves the ones with a card leg coming.

One transaction per tender leg. A $114.57 shop settled $40.75 gift card +
$73.82 Mastercard has a statement line for $73.82 only. A single row marked
credits is excluded from the queue while that line double-counts; marked card it
is searched for at 1% of $114.57 and never matches. Either way the shop books
$188.39. Per-leg rows make each amount the settled amount, so the matcher works
untouched.

Reconciliation now carries expense_metadata across. It already moved overrides,
tags and splits from the manual row to the statement row and left metadata
behind, which did not matter while metadata only came from an email that made
its own transaction. It matters now that it carries a shop's line items:
unmoved, the contents vanish at exactly the moment the statement line appears,
and COLES 0556 MANOR LAKES stays as unreadable as before anything was scanned.
transaction_id is UNIQUE, so a statement row that already has metadata keeps it
and the pantry row is flagged rather than raising a constraint violation.

Also regenerates the Prisma model. card_last4, currency, flags, reconciled_at,
matched_transaction_id, platform and route have been in the database since
migrations 0019/0020 and were absent from schema.prisma — regenerating the
client from it would have dropped columns the order lane writes on every ingest.

23 integration tests against the real schema, built from the three receipts that
drove the design. Existing suites unchanged: 104 unit, 144 integration.

src/app/api/receipts/ingest/route.ts

@@ -0,0 +1,52 @@
+import { NextRequest, NextResponse } from "next/server";
+import { processReceiptIngestion, ReceiptValidationError, validateReceipt, type ParsedReceipt } from "@/lib/receipt-ingestion";
+
+/**
+ * Machine ingest endpoint for grocery receipts scanned in pantry-app.
+ *
+ * Sibling to /api/orders/ingest and deliberately shaped like it. Auth is a shared secret
+ * rather than the Traefik `x-forwarded-user` header: this is called app-to-app, and there
+ * is no browser session to forward.
+ *
+ * Its own token rather than ORDER_INGEST_TOKEN so pantry's credential can be rotated
+ * without touching the n8n order flow, which runs on a schedule nobody is watching.
+ */
+function authorised(req: NextRequest): boolean {
+  const expected = process.env.RECEIPT_INGEST_TOKEN;
+  if (!expected) return false; // fail closed when unconfigured
+  const got = req.headers.get("x-ingest-token");
+  return !!got && got === expected;
+}
+
+export async function POST(req: NextRequest) {
+  if (!authorised(req)) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  let body: ParsedReceipt & { dryRun?: boolean };
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "invalid JSON" }, { status: 400 });
+  }
+
+  if (!body?.merchant_name || !body?.transaction_date || typeof body?.total !== "number" || !Number.isInteger(body?.capture_event_id)) {
+    return NextResponse.json({ error: "merchant_name, transaction_date, total and capture_event_id are required" }, { status: 400 });
+  }
+
+  try {
+    // Dry run validates and reports what would be written without writing it — the same
+    // affordance every maintenance script in pantry has, and for the same reason: the first
+    // pass over a new receipt format is worth reading before it becomes money.
+    if (body.dryRun) return NextResponse.json({ kind: "receipt", dryRun: true, flags: validateReceipt(body) });
+    const result = await processReceiptIngestion(body);
+    return NextResponse.json({ kind: "receipt", ...result });
+  } catch (e) {
+    // A receipt that will not validate is the failure that matters: it means the payment
+    // side was read wrong, and booking it anyway would put a number in the ledger nobody
+    // can stand behind. Loud, like OrderParseError.
+    if (e instanceof ReceiptValidationError) {
+      return NextResponse.json({ kind: "rejected", reason: e.message }, { status: 422 });
+    }
+    const message = e instanceof Error ? e.message : String(e);
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

src/app/api/transactions/reconcile/route.ts

@@ -77,6 +77,36 @@ export async function POST(req: NextRequest) {
         await tx.transaction_splits.deleteMany({ where: { transaction_id: manual_id } });
       }
 
+      // Move provenance: manual → statement tx.
+      //
+      // Overrides, tags and splits above were always carried across; expense_metadata was
+      // the one child left behind, which did not matter while every metadata row came from
+      // an email that had created its own transaction. It matters now: a scanned grocery
+      // receipt puts its line items here, and reconciliation hides the manual row from
+      // every figure — so without this the shop's contents disappear at exactly the moment
+      // the statement line appears, and `COLES 0556 MANOR LAKES` stays as unreadable as it
+      // was before the receipt was ever scanned.
+      //
+      // transaction_id is UNIQUE, so a statement row that already has metadata (an emailed
+      // or Paperless copy got there first) keeps it. The pantry row stays attached to the
+      // reconciled manual transaction and is flagged, rather than raising a constraint
+      // violation or silently overwriting the other source.
+      const moved = await tx.$executeRawUnsafe(
+        `UPDATE expense_metadata SET transaction_id = $1
+          WHERE transaction_id = $2
+            AND NOT EXISTS (SELECT 1 FROM expense_metadata other WHERE other.transaction_id = $1)`,
+        statement_tx_id,
+        manual_id
+      );
+      if (moved === 0) {
+        await tx.$executeRawUnsafe(
+          `UPDATE expense_metadata
+              SET flags = coalesce(flags, '[]'::jsonb) || '["metadata_collision_on_reconcile"]'::jsonb
+            WHERE transaction_id = $1`,
+          manual_id
+        );
+      }
+
       // Mark manual tx as reconciled (link to statement tx)
       await tx.$executeRawUnsafe(
         `UPDATE transactions SET reconciled_with_id = $1 WHERE id = $2`,