Hide candidate URLs, report unavailable notifications, clear grounded links

Release corrections from the review of promotion pull request #98:

- MQ-98-01: recipe-candidates returns an opaque candidate_id (an HMAC of
  the dinner and page under a per-process key) that the server resolves
  to the page it last offered that dinner. Candidate URLs, which may
  carry a token, no longer reach responses or the service-worker cache.
- MQ-98-02: "Turn on notifications" no longer finishes onboarding
  silently when notifications are unavailable (or denied); the step says
  plainly that nothing was turned on and offers "Finish setting up".
  The placeholder stays until Feature 19 wires Web Push.
- MQ-98-03: GroundPendingDinner clears the pasted recipe_url when
  background grounding succeeds, as manual grounding already did.

Maestro task 6819ce33-3715-4bd4-9208-a54a8b5cee02.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

migrations/queries/dinners.sql

@@ -118,9 +118,11 @@ RETURNING *;
 -- the grounding_revision it was grounded for; a dinner grounded some other
 -- way, renamed or archived meanwhile is left as it is (0 rows). A method,
 -- minutes_total or difficulty already set is kept: a pending dinner has
--- them only when a member edited them while it was grounding.
+-- them only when a member edited them while it was grounding. Like
+-- GroundDinner it clears the pasted recipe_url: the recipe replaces the link.
 UPDATE dinners
 SET recipe_id = sqlc.arg(recipe_id),
+	recipe_url = NULL,
 	photo_id = sqlc.arg(photo_id),
 	method = COALESCE(method, sqlc.arg(method)),
 	minutes_total = COALESCE(minutes_total, sqlc.arg(minutes_total)),