[paultristanwagner]

All code in this PR was written by an AI agent (Claude Opus 5.5) working with me; I directed it and tested the results on my own account. Feel free to take, change or drop any part of it.

Part of #73.

Adds a lookup_barcode tool: find foods by the barcode on their
package, the same lookup the app's scanner does. Barcodes can already be
attached to custom foods (#69); this is the read side.

The scanner calls POST /api/v2/barcode:

{"query": "4006381333931", "auth": {…}, "config": {"call_version": 2}}

A known code answers {"foodId": <first match>, "foods": [<full food objects, as get_food returns them>]}; an unknown one answers
{"result": "SUCCESS"} with no foods. Verified against the live API:

• the server ignores leading zeros: UPC-A 049000050103 and
  0049000050103 both find foods stored as "49000050103"
• it doesn't validate the code: 0000000000000 returns 19 unrelated
  restaurant foods whose stored barcode is "0"

Changes:

• client: lookup_barcode(barcode) validates the code with
  normalize_barcodes (so a misread digit fails the check digit instead of
  matching nothing), refuses an all-zero code, and returns only the foods
  whose barcodes actually contain it (compared without leading zeros).
• server: lookup_barcode tool, returning each food's id, name,
  source, default measure, measures and barcodes, ready for
  add_food_entry.
• README: tool table row.

https://claude.ai/code/session_01MCJFDo71qoSqTRtcGfkpXJ