feat: harden provider onboarding and resolution

[maxjustships]

Summary

• add secure XDG provider configuration, interactive nomnom setup, and probe-backed nomnom doctor --json
• move OFF search to the official api.openfoodfacts.org REST host with bounded, injectable retries for 429/5xx; direct requests remains intentional and documented (no third-party SDK)
• add USDA schema-aware nutrient parsing, positive-core-nutrient validation, token/data-type/category confidence scoring, FDC provenance, and serving-field-only piece weights
• correct leading N pieces FOOD at Xg quantity multiplication and preserve cache/log/alias migrations

Validation

• clean venv: pip install -e ".[dev]" then 121 passed and ruff check .
• CLI smoke: 3 pieces egg whole cooked fried at 38g resolved to 114.0 g
• live OFF official search-host smoke: HTTP 200
• non-interactive setup returns a structured actionable error without prompting or persisting a credential

Closes #13
Closes #14
Closes #15