shopping list: phone-synced card via relay

Pick one #einkauf-tagged card as "active"; its body is pushed to the
relay on every sync.tick and rendered on a phone-friendly session-
auth'd page at /shopping. Phone shows only the open "- [ ]" items as
tappable rows — tapping flips the line to "- [x]" on the relay in
place. The next client tick pulls those toggles back and PATCHes the
local card, so hyprcrd stays the source of truth for item text.

  - Relay: shopping_state table (one row per tenant), POST/GET
    /api/shopping for content push/pull, POST /api/shopping/check
    for phone toggles, GET /shopping for the phone UI.
  - Client: hamburger menu in the header with an "Einkaufsliste"
    entry that opens a picker listing all #einkauf cards with a
    radio for the active one. Timestamp cursors in localStorage
    keep push/pull idempotent.
  - Phone can only toggle, not edit text — edit stays in hyprcrd,
    which makes the merge trivial (last-writer wins by timestamp).

Multi-card support is there (any card with #einkauf is a candidate)
but only one is active for the phone at a time, per the spec.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

relay/index.php

@@ -65,10 +65,15 @@ if (str_starts_with($route, '/api/')) {
     require __DIR__ . '/inc/routes/collab-buckets.php';
     require __DIR__ . '/inc/routes/collab-cards.php';
     require __DIR__ . '/inc/routes/collab-locks.php';
+    require __DIR__ . '/inc/routes/shopping.php';
 
     jsonResponse(['error' => 'not found'], 404);
 }
 
 // ── UI ─────────────────────────────────────────────────────────────
 
+// Shopping UI lives outside /api/ so phones can bookmark a clean URL.
+// File has both /api/shopping* and /shopping handlers; they short-
+// circuit on match, so loading it here for the non-API path is safe.
+require __DIR__ . '/inc/routes/shopping.php';
 require __DIR__ . '/ui/layout.php';