fix(shopping): stale-row cleanup, cache-busting, view persistence

Root cause of the doubled lists: the relay DB had stale rows from
previous activations that were never deleted. The composite PK
prevented same-uid duplicates but not leftover rows from cards that
were deactivated without a successful DELETE.

Fixes:
  - Client tick sends DELETE { keep: [active uids] } after every
    push cycle. The relay drops all rows for this tenant that aren't
    in the keep list — cleans up migration leftovers, failed deletes,
    old single-list sentinels, everything in one shot.
  - Relay DELETE endpoint accepts { keep: [...] } for bulk cleanup
    alongside the existing { card_uid } single-delete.
  - Relay layout.php adds cache-busting query strings on style.css
    and app.js via filemtime() so phone browsers pick up new code
    on deploy instead of serving stale cached versions.
  - showView persists the active view name to localStorage; after
    login the relay restores it instead of always landing on compose.
  - Shopping-list-box border/background removed — items have their
    own chrome, the box is just a flex grouper now.
  - View title is always "Shopping"; each list box keeps its own
    header with the card title. No more doubled name.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

relay/inc/routes/shopping.php

@@ -63,11 +63,30 @@ if ($route === '/api/shopping' && $method === 'POST') {
 }
 
 // ── DELETE /api/shopping ─────────────────────────────────────
+// Two modes:
+//   { card_uid: "123" }         → delete one specific list
+//   { keep: ["123", "456"] }    → delete everything EXCEPT these
 if ($route === '/api/shopping' && $method === 'DELETE') {
     if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
     $input = json_decode(file_get_contents('php://input'), true) ?: [];
+    $keep = is_array($input['keep'] ?? null) ? $input['keep'] : null;
     $uid = trim((string)($input['card_uid'] ?? ''));
-    if ($uid === '') jsonResponse(['error' => 'card_uid required'], 400);
+
+    if ($keep !== null) {
+        // Bulk cleanup: keep only the listed card_uids, drop the rest.
+        if (count($keep)) {
+            $placeholders = implode(',', array_fill(0, count($keep), '?'));
+            $params = array_merge([$clientTenant['id']], array_map('strval', $keep));
+            $db->prepare("DELETE FROM shopping_state WHERE tenant_id = ? AND card_uid NOT IN ($placeholders)")
+                ->execute($params);
+        } else {
+            $db->prepare('DELETE FROM shopping_state WHERE tenant_id = :t')
+                ->execute(['t' => $clientTenant['id']]);
+        }
+        jsonResponse(['ok' => true]);
+    }
+
+    if ($uid === '') jsonResponse(['error' => 'card_uid or keep[] required'], 400);
     $db->prepare('DELETE FROM shopping_state WHERE tenant_id = :t AND card_uid = :u')
         ->execute(['t' => $clientTenant['id'], 'u' => $uid]);
     jsonResponse(['ok' => true]);