shopping list: phone-synced card via relay

Pick one #einkauf-tagged card as "active"; its body is pushed to the
relay on every sync.tick and rendered on a phone-friendly session-
auth'd page at /shopping. Phone shows only the open "- [ ]" items as
tappable rows — tapping flips the line to "- [x]" on the relay in
place. The next client tick pulls those toggles back and PATCHes the
local card, so hyprcrd stays the source of truth for item text.

  - Relay: shopping_state table (one row per tenant), POST/GET
    /api/shopping for content push/pull, POST /api/shopping/check
    for phone toggles, GET /shopping for the phone UI.
  - Client: hamburger menu in the header with an "Einkaufsliste"
    entry that opens a picker listing all #einkauf cards with a
    radio for the active one. Timestamp cursors in localStorage
    keep push/pull idempotent.
  - Phone can only toggle, not edit text — edit stays in hyprcrd,
    which makes the merge trivial (last-writer wins by timestamp).

Multi-card support is there (any card with #einkauf is a candidate)
but only one is active for the phone at a time, per the spec.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

relay/inc/bootstrap.php

@@ -233,6 +233,20 @@ $db->exec('CREATE TABLE IF NOT EXISTS chat_room_members (
 )');
 $db->exec('CREATE INDEX IF NOT EXISTS idx_chat_room_member_tenant ON chat_room_members(tenant_id, room_uid)');
 
+// Shopping list: one active card per tenant, body mirrored from the
+// client. Phone toggles checkboxes in-place via the session UI — no
+// multi-list fan-out, no history, no attachments. hyprcrd remains the
+// only surface that edits item text.
+$db->exec('CREATE TABLE IF NOT EXISTS shopping_state (
+    tenant_id INTEGER PRIMARY KEY,
+    card_uid TEXT NOT NULL,
+    title TEXT NOT NULL DEFAULT "",
+    body TEXT NOT NULL DEFAULT "",
+    updated_at_client TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at_server TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE
+)');
+
 // Sync-event notifications: replaces the old bot-chat mechanism. When a
 // client syncs a card they received, they POST here; the sender polls
 // GET /api/sync-events and surfaces each as a transient toast. Rows are