Add the Rotation check: MarkTried and keep/drop decisions

Per D-021, plan.MarkTried(date) moves every Quest log dinner planned on
a household-local date (any plan status) to tried and opens a pending
rotation_reviews row; a dinner already checked for the date is left as
it is, so it is idempotent and never re-marks a dinner returned to the
Quest log.

GET /api/v1/rotation-reviews lists the pending checks as
{dinner {id, name, photo}, plan_date}. POST
/api/v1/dinners/{id}/rotation-review {decision} applies keep (Regular,
origin kept), drop ("Not for us", archived) or not_made ("We didn't
make it", back to the Quest log), closing the check with decided_at and
the session's updated_by; a second decision is 409 no_pending_review.

A dropped dinner's name joins the passed names: ListDeclinedSuggestionNames
and ListRecentDeclinedNames become ListPassedNames and
ListRecentPassedNames, which also read Rotation checks decided drop, so
the Side quest dedupe and household context never suggest it again.

A static test guards that keep is the only path to Regular: every query
writing dinners.status and every use of the regular status is reviewed.

Maestro: a1887d1c-c405-478c-ac7d-8cb8b40d280d

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/server.go

@@ -43,8 +43,9 @@ type RouteMounter interface {
 // suggestSvc serves POST /api/v1/suggestions/batches, GET
 // /api/v1/suggestions/deck and POST /api/v1/suggestions/{id}/accept and
 // /decline; planSvc serves GET /api/v1/plans/{weekStart}, POST
-// /api/v1/plans/{weekStart}/draft and PUT
-// /api/v1/plans/{weekStart}/days/{date}; runner serves
+// /api/v1/plans/{weekStart}/draft, PUT
+// /api/v1/plans/{weekStart}/days/{date}, GET /api/v1/rotation-reviews and
+// POST /api/v1/dinners/{id}/rotation-review; runner serves
 // POST /api/v1/jobs and GET /api/v1/jobs/{id}; photos serves
 // GET /media/photos/{id}-{size}.jpg; assets is the web build
 // served for every other GET. /health, /auth and the web build are public.
@@ -125,6 +126,8 @@ func NewRouter(logger *slog.Logger, version string, trusted forwarded.Trusted, a
 	apiV1.Get("/plans/{weekStart}", getPlan(logger, planSvc))
 	apiV1.Post("/plans/{weekStart}/draft", postPlanDraft(logger, planSvc))
 	apiV1.Put("/plans/{weekStart}/days/{date}", putPlanDay(logger, planSvc))
+	apiV1.Get("/rotation-reviews", getRotationReviews(logger, planSvc))
+	apiV1.Post("/dinners/{id}/rotation-review", postRotationReview(logger, planSvc))
 	apiV1.Post("/jobs", postJob(logger, runner))
 	apiV1.Get("/jobs/{id}", getJob(logger, runner))
 	media.Get("/photos/{name}", getPhoto(logger, photos))