Tighten meal write contracts

[colinds]

Summary

• require exact (menuId, itemId) write identity and positive source-piece ownership
• keep client-side validation limited to request construction, ownership, selections, and the local preview ceiling
• add Forkable's dietary advisory, direct billing values, and per-owned-order delivery status
• cover the write handlers with a fake Forkable client; tests make no live writes

This is an intentional MCP contract update. Agents should re-read the tool schemas; there are no
legacy item-id-only aliases.

Verification

• bun run check
• packaged smoke test with Bun and Node

Stack: 3 of 4. Depends on #1; followed by #3.