feat(meals+auth): remove Person from meals v2 DTOs (MemberRef) and adopt Argon2 hashing

backend-spec.md

@@ -280,14 +280,16 @@ Impact on existing routes (exact files to refactor):
 
 Status summary:
 - Implemented: JWT auth v2 with refresh cookie; household domains and membership; invitations; full household scoping across recipes/meals/shopping; OpenAPI augmentation with bearerAuth and 403; RFC7807 preserved; tests green.
-- Preserved from v1: camelCase response models, `Page<T>` pagination and cursor semantics, `Location` headers on create, shopping storeName normalization ("home").
+- DTO alignment: Meals v2 now uses MemberRef { id, displayName } for chefs/cleanup/consumers (no Person in outward schema). Tests updated accordingly.
+- Security: Password hashing now prefers Argon2 for new accounts with PBKDF2 verification fallback.
+- Preserved: camelCase responses, `Page<T>` semantics, `Location` headers on create, shopping storeName normalization ("home").
 
-Remaining work (post-v2 cleanup):
-- Remove `persons/` package and any residual references; consolidate entirely on `users`.
-- Optional: migrate PBKDF2 to argon2/bcrypt and add password rehash-on-login.
-- Invitations: integrate email delivery provider and track send status.
-- DB: Add composite indices like `(household_id, id)` for common pagination; evaluate adding FK constraints from tenant tables to `households(id)` where safe.
-- Rename `*_v2.py` modules back to canonical names once v1 has been fully retired (routers already removed) to reduce duplication noise.
+Remaining work (prioritized cleanup):
+1. Remove `persons/` package and any residual references; consolidate entirely on `users` / `household_members`. Keep internal mapping until repositories updated.
+2. Recipes outward fields: migrate `createdBy`/`hiddenBy` to a user/member DTO (no Person) similar to meals MemberRef.
+3. Finalize v1→v2 switchover: delete v1 routers (`api/auth.py`, `api/persons.py`, `api/recipes.py`, `api/meals.py`, `api/shopping.py`) and rename `*_v2.py` to canonical names. Extract shared DTOs/helpers (currently imported from `api.shopping`) into the canonical module to avoid cross-file dependencies.
+4. Invitations: integrate email delivery provider and track send status.
+5. DB: Add composite indices like `(household_id, id)` for pagination; evaluate additional FKs to `Household(id)`.
 
 ---
 

frontend-spec.md

@@ -0,0 +1,44 @@
+# Frontend Integration Spec (Household v2)
+
+Date: 2025-11-01
+
+This document summarizes the current backend API surface (post v2 migration) and the prioritized actions to keep the frontend aligned.
+
+## Current API Highlights
+
+- Auth: JWT bearer via `/api/v1/auth/register|login|refresh|logout`; refresh via HttpOnly cookie.
+- Households: create households and list memberships.
+- Household-scoped resources under `/api/v1/households/{householdSlug}`:
+  - Recipes: list/get/create/delete (soft-hide); list supports `q`, `cursor`, `limit`.
+  - Meals: upcoming/get/create/update/delete; mark consumed.
+  - Shopping: current aggregate; list-by-id; purchase; request/unrequest meal.
+- RFC7807 Problem Details standardized for errors.
+- OpenAPI includes bearerAuth and 403 for protected household routes.
+
+## DTO alignment
+
+- Meals v2 participants (chefs, cleanup, consumers) now use MemberRef:
+  - `{ id: number, displayName: string }`
+  - Returned in MealOut; sent in MealIn. No legacy `Person` in outward schema.
+
+- Recipes v2 outward DTO currently omits `createdBy` in v2 list/create responses; if exposed later, it will use a user/member shape (no Person).
+
+## Breaking changes to watch for
+
+- Person removed from meals outward schema; use MemberRef.displayName instead of `name`.
+- Household slug is required in all v2 data routes.
+
+## Prioritized Actions (Frontend)
+
+1) Replace any usage of Person in meals UI/state with MemberRef { id, displayName }.
+2) Verify create/update meal payloads send participants in the new format (displayName).
+3) Ensure auth flow relies on JWT bearer and refresh cookie; remove legacy cookie logic if still present.
+4) Align OpenAPI client generation with the updated schema (regenerate clients).
+
+## Upcoming backend cleanups (FYI)
+
+- Remove v1 routers; rename `*_v2.py` to canonical; drop `persons/` package.
+- Expose user/member DTO for recipe authorship if needed.
+- Add invitation email delivery.
+- DB indices/FKs polish.
+

requirements.txt

@@ -4,4 +4,4 @@ httpx==0.27.2
 ingredient-parser-nlp==1.1.2
 beautifulsoup4==4.12.3
 aiosqlite==0.20.0
-argon2-cffi==23.1.0
+argon2-cffi==23.1.0