Restore and expand Thuisbezorgd support

[foeken]

Summary

This restores the Thuisbezorgd integration against the current production web/API contracts and fills out its authenticated account, discovery, cart, address, and tracking flows.

Authentication

• replace the broken direct email/OTP flow with browser-assisted OAuth 2.0 PKCE in an isolated Chrome profile
• intercept the registered callback and exchange the authorization code locally
• support current Cloudflare Turnstile, tenant, and application headers
• encrypt credentials locally with mode 0600
• fix Node 22 node-machine-id interop

Discovery and menus

• switch restaurant discovery to the current geocode + /discovery/nl/restaurants/enriched APIs
• support delivery vs collection and open_now filtering
• expose availability, service options, distance, ETA, fee bands, deals, tags, address, ratings, and complete source metadata
• preserve discovery metadata when fetching the restaurant menu
• parse the current split menu page state

Cart and account

• persist platform clients across MCP calls so cart state survives add_to_cart -> get_cart
• support current basket create/read/clear behavior
• add saved-address create, update, and delete tools
• improve Dutch saved-address mapping and geolocation

Orders

• implement order history and live order tracking
• expose detailed ETA, delay, status history, confidence, service type, and safe courier capability flags
• do not expose PubNub channel credentials
• remove cancel_order from the MCP surface because cancellation is not implemented
• keep final payment explicitly browser-only

Transport and docs

• add a bearer-protected Streamable HTTP transport alongside stdio
• add health and OAuth protected-resource metadata endpoints
• update both READMEs to match the actual MCP surface
• include MCP server tests in the normal workspace test run

Validation

• pnpm build
• pnpm typecheck
• pnpm test — 41 tests
• pnpm --filter @henkas/orderfood check:pack
• live browser OAuth + token refresh
• live authenticated account, address, discovery, menu, cart, history, and tracking checks
• live delivery/collection and open-now filtering
• live Streamable HTTP MCP initialization, tool listing, bearer rejection, and health check

No order was placed or cancelled during validation.

[sonarqubecloud]

Quality Gate passed

Issues
12 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.2% Duplication on New Code

See analysis details on SonarQube Cloud