Release: one log page, grouped dishes, live search (#1)

Structure
- Kirjaa and Historia are one page. They were two views of the same thing — every history row already linked into the logger, and the logger had a day switcher. Two tabs instead of three. Also closed a gap: on an already-logged day there was no way to swap to a different dish, only to re-pick its sides.
- Ruoat → Ruuat, label and route.
- The catalog has a structure. It had no top-level headings at all — the mains simply began with "Liha". Both halves now carry a heading and a count, categories are visibly subordinate, and the add/edit forms collapse instead of filling the screen before any content.

Finding things
- Dishes grouped by category on both screens, Sekalaiset for multi-category ones. Derived from the stored set, not a fifth category, so one Tortillat still covers all four for the §8.1 suggester later.
- Live search on both lists, 250 ms after typing stops. Both remain plain GET forms, so they still filter with JavaScript off.
- History is paged 30 days at a time — it previously rendered every day back to the first entry, forever.

Correctness
- Future meals refused. The picker offered them and ?pvm= accepted them.
- today() wasn't midnight, so it never equalled a date parsed from ?pvm= — after saving, the card read "la 5.9. kirjattu" instead of "Tänään kirjattu".
- Deletes ask first, for dishes and logged meals. The meal is the more destructive: a dish is only soft-deleted.
- DB open failures name the path and uid, instead of unable to open database file (14).

Visual
- Category icons replace colour dots — steak, drumstick, fish, leaf, quartered circle.
- Row actions are a pencil and a bin; the header has a surface.

Housekeeping
- Datastar SDK dropped — one JSON decode was pulling in four modules including an HTTP compression stack. Five lines replace it.
- Release policy documented: main protected, releases arrive as PRs.

Co-authored-by: Esa Kataja <[email protected]>
Reviewed-on: #1

PRD.md

@@ -321,7 +321,7 @@ build and no asset bundler.
   lines of `database/sql`. There are no down-migrations: restoring the
   database file is the rollback for a single-household app.
 - **Bundle import**: the §7.3 mass import is a live feature of the running
-  app, on the Ruoat tab — paste JSON or upload a file, get a per-row report
+  app, on the Ruuat tab — paste JSON or upload a file, get a per-row report
   back. A plain multipart form rather than a Datastar round trip, since the
   response is a whole-page report and a form needs no client code. Uploads
   are capped at 1 MiB. The same importer is also reachable as
@@ -360,7 +360,10 @@ on the server and run with Docker Compose.
 
 - **Branches**: `main` carries released versions only, so its history is the
   deployment history and every release tag points into it. Development happens
-  on `dev` and merges into `main` when a release is cut.
+  on `dev`, and `main` is protected on the remote: it accepts no direct
+  pushes, so a release arrives as a pull request from `dev`. `make image`
+  additionally refuses to run outside `main` — that one has to be local,
+  because the tag and the image are made before anything reaches the remote.
 - **Versioning**: CalVer `vYYYYMMDD-N`, where `N` is the Nth build of that
   day. `make image` derives `N` by counting the day's existing git tags,
   creates the new tag, and bakes the version into the binary through