Make recipe repairs conditional and keep pasted links out of logs

F1: A candidate or link repair now writes the dinner only if it is still
unarchived and as observed before grounding (normalized_name,
grounding_status, grounding_revision and recipe_id). A dinner renamed or
grounded some other way meanwhile is ErrGroundConflict (409
ground_conflict); one archived, before or during the repair, is
ErrArchived (409 dinner_archived). Manual repairs reject archived dinners
too.

F2: Any failure grounding a candidate or link by hand wraps
ErrGroundFailed, which the API logs as reason=ground_failed with the
dinner id only, never the pasted link or dependency error text.
GroundURL no longer formats the link into its error.

Maestro task 8741cedb-1849-4e3f-8d05-f5648c77c7ee.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -250,7 +250,14 @@ automatic** (D-021).
   `search_failed` / `ai_failed` (only the reason code is logged, never the
   provider's text), and grounding a candidate or link that runs past 90
   seconds (fetch, photo and `normalize_recipe`, all in the request) 504
-  `ground_timeout`, leaving the dinner unchanged.
+  `ground_timeout`, leaving the dinner unchanged. An archived dinner is 409
+  `dinner_archived`. A candidate or link is written only if the dinner is
+  still as it was before grounding began: one renamed or grounded some
+  other way meanwhile is 409 `ground_conflict`, and one archived meanwhile
+  409 `dinner_archived`, either leaving the dinner unchanged. Any other
+  failure grounding a candidate or link is 500, logged with a fixed reason
+  and the dinner id only — never the link, which can carry a personal
+  token, or dependency error text.
 - `/health` — liveness.
 - Everything else serves the embedded PWA with SPA fallback.