fix: send ntfy metadata as HTTP headers, add auto-login from notification click

- ntfy.py: switch from JSON body to HTTP headers (Title, Priority, Tags,
  Actions, Click) with plain message body. ntfy servers treat the POST
  body as the message, so JSON body fields were ignored and displayed as
  raw JSON.
- ntfy.py: replace em dashes in headers with hyphens (HTTP headers must
  be latin-1 encodable).
- meals.py: add /auto-login/<token> route that logs users in via their
  ntfy callback token so clicking a notification opens the dashboard
  without re-entering credentials.
- ntfy.py: update Click URL to /auto-login/<token>?date=...

meals.py

@@ -342,6 +342,33 @@ def ntfy_callback():
     return {"message": "Response recorded", "status": status}, 200
 
 
+# ── Auto-login from ntfy notification click ──────────────────────────────────
+
+@meals_bp.route("/auto-login/<token>")
+def auto_login(token):
+    """Log in a user via their ntfy callback token, then redirect to dashboard.
+
+    Clicking an ntfy notification opens this URL.  The callback token
+    identifies the user, so they don't need to re-enter credentials.
+    """
+    user = get_user_by_callback_token(token)
+    if user is None:
+        flash(t("Invalid login link."), "error")
+        return redirect(url_for("auth.login"))
+
+    session["user_id"] = user["id"]
+    session["username"] = user["username"]
+    session["is_admin"] = bool(user["is_admin"])
+    session["household_id"] = user["household_id"]
+    session["household_name"] = user["household_name"] or ""
+
+    date_param = request.args.get("date", "")
+    target = url_for("meals.dashboard")
+    if date_param:
+        target += f"?date={date_param}"
+    return redirect(target)
+
+
 # ── Cron tick (called by meal-cron container) ─────────────────────────────────
 
 REMINDER_HOURS = {"lunch": 10, "dinner": 16}