web: browse upcoming days' menus (foodpro date window) #72

What to build

The menu API supports future dates and the official app exposes them; UDine only ever shows today. Documented + live-verified 2026-08-19 (see docs/apk-reverse-engineering.md, "Future dates" bullet): same foodpro-menu-ajax endpoint, date=MM/DD/YYYY, rolling window of today through roughly +13 days; past dates and beyond-window dates return [] (HTTP 200). @udine/shared's fetchMenu(hallTid, date) and the web /api/menu?tid&date=YYYY-MM-DD proxy already accept arbitrary dates — this is UI + loader wiring, not a new client.

Scope (web + shared only — mobile date nav is deferred until #65's restyle lands, note it on the epic when closing):

• web/src/routes/halls/[slug]: date navigation — prev/next-day controls + a "Today" reset, date carried as ?date=YYYY-MM-DD URL state (shareable, back-button friendly, SSR-consistent). Show the browsed date clearly (the page already renders data.date).
• Bounds: no past days (API has no history — disable/hide prev at today); forward navigation allowed past the data window, but an out-of-window day renders a proper empty state ("Menu not posted yet — UMass publishes about two weeks ahead"), NOT the generic no-menu-today copy and NOT an error page.
• Logging from a future day's menu stays exactly as-is: entries record at loggedAt = now. No future-dated logging in v1 (decided — planning is browsing, not logging).
• If any date math helper is needed beyond one-liners, put it in @udine/shared with red-first unit tests.

Constraints (standing policy)

• Red-green TDD: every new spec red-first with pasted failure lines; existing halls-menu.spec.ts / vertical-slice.spec.ts must stay green unweakened — if modified, fresh red evidence per change. Mock /api/menu per-date in e2e (distinct payloads for today vs tomorrow proves the wiring; an []-shaped… note: the web proxy returns a parsed items array, so mock [] items for out-of-window).
• Tokens/components only; PORT-isolated Playwright; anonymous-first (zero auth, zero Supabase).
• Do not touch / (home) — PR web IA: Today-first home #69 (web IA: Today-first home #64) may land concurrently; if it merges first, rebase over it.

Acceptance criteria

• Tomorrow's real menu browsable on the dev server (live verification against the real API, not just mocks)
• Prev disabled at today; out-of-window day shows the publish-window empty state (e2e, red-first)
• URL state round-trips (deep-link to ?date=… renders that day; e2e)
• Log flow from a future menu records at now (spec proves it)
• Full suite green, check clean, build clean, CI green