feat: add source-backed zero-friction capture

[maxjustships]

Summary

• add safe USDA generic proxies with explicit policy, provenance, and branded/SKU denial
• add OFF v2 barcode capture and agent-extracted package-label capture with validated local provenance
• migrate user SQLite data to schema v4 without losing existing cache/log/recipe/alias data
• document the no-manual-label conversational agent workflow and privacy boundary

Verification

• /tmp/nomnom-v04-venv/bin/pytest -q (155 passed)
• /tmp/nomnom-v04-venv/bin/ruff check .
• fresh installed-console temp-DB smoke: help/version, capture label, alias, offline log, invalid capture, schema v4

Closes #19