Phase 3a: close the Django API gaps for the MCP server

Backend prerequisites for the FastMCP service (mcp.md §6) — no model
changes, no migration.

- log_cook: accepts `rating`, validates via full_clean (enforces the
  exactly-one-recipe rule), and returns `used_ingredients` as a
  suggestion set instead of mutating the pantry. Auto-deduct path and
  _deduct_ingredient removed — pantry state changes only via set-state
  after the user confirms.
- New POST /api/pantry/set-state/ — set in/low/out by ingredient name
  (alias-aware), optional location; registered before the router so the
  pantry detail route doesn't capture "set-state" as a pk.
- what_can_i_cook: presence-based (exclude 'out', tolerate null
  quantity) so the API matcher agrees with the web one.
- bulk-pantry-add: restocks an existing ingredient+location row to 'in'
  instead of duplicating; quantity is an optional int.

Tests cover all four + that pantry `state` is serialized (24 pass).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

kitchen/urls.py

@@ -16,6 +16,9 @@ router.register(r"cook-log", views.CookLogViewSet)
 router.register(r"shopping-list", views.ShoppingListItemViewSet)
 
 urlpatterns = [
+    # Must precede the router include — otherwise the PantryItem detail route
+    # (pantry/<pk>/) captures "set-state" as a pk.
+    path("pantry/set-state/", views.set_pantry_state, name="set-pantry-state"),
     path("", include(router.urls)),
     path("what-can-i-cook/", views.what_can_i_cook, name="what-can-i-cook"),
     path("log-cook/", views.log_cook, name="log-cook"),