Fix critical auth, nutrition cache, and allergen regressions

[cursor]

Bug and impact

• Token refresh returned valid auth tokens without provisioning a missing app users row, leaving affected sessions with GET /users/me 404s and downstream foreign-key 500s on meal-log/profile writes.
• Daily nutrition summaries could stay stale for up to 24h after meal-log create/delete because cached daily totals were not invalidated.
• Authenticated Spoonacular recipe searches did not send user allergens upstream, and the local DB allergen filter only matched exact spellings such as peanuts vs peanut.

Root cause

• Signup/login self-healing was not mirrored in refreshSession.
• MealLogService wrote/deleted rows without clearing nutrition:daily:{userId}:{date}.
• Recipe search ignored the existing Spoonacular intolerances option and the DB query used unexpanded allergen strings.

Fix

• Added shared auth user provisioning for signup/login/refresh and explicit no-email handling.
• Added daily nutrition cache invalidation after meal-log create/delete.
• Added FDA allergen alias expansion for local catalog filtering and mapped user allergens to Spoonacular intolerances with allergen-specific search cache keys.
• Added focused backend tests for all three regressions.

Validation

• pnpm exec prettier --check apps/backend/src/services/auth.service.ts apps/backend/src/services/meal-log.service.ts apps/backend/src/services/nutrition.service.ts apps/backend/src/services/recipe.service.ts apps/backend/tests/auth.test.ts apps/backend/tests/meal-log.test.ts apps/backend/tests/recipe.service.test.ts
• pnpm --filter @snacktrack/backend test
• pnpm --filter @snacktrack/backend lint
• DATABASE_URL=postgresql://localhost:5432/snacktrack_test DIRECT_URL=postgresql://localhost:5432/snacktrack_test pnpm --filter @snacktrack/backend build