Canteen Management

Continuation of W8 (D33 built ProductionPlanLine generation from a frozen meal sheet, but the plan was write-only -- no read endpoint, no portal page, no print layout). D34 closes that loop with a real cook sheet, per the prototype's production.html.

Backend:

• IProductionPlanService.GetForDateAsync -- every plan line for a service date, recipe name/code/portion/cost resolved via the same RecipeCostCalculator every other page uses.
• New ProductionController (GET /api/canteen/production/plan?date=), gated on the Kitchen capability + the pre-existing (until now unused) canteen.production.read permission key.
• Honest about two real gaps rather than fabricating: CanteenForecastPortions stays 0 (forecast service F4-1 does not exist) and ActualServed stays 0 (nothing posts a completed POS sale back to the plan yet) -- both called out in a DomainFootnote on the page, not hidden or invented.

Frontend:

• queries/production.ts + components/shared/production-view.ts (pure grouping/progress helpers, unit tested).
• production/page.tsx rewritten: the old build-time EmptyState placeholder (written before Dietary existed) replaced with a real cook sheet grouped by meal slot, 4 StatCards matching the prototype, and a Print cook sheet button.
• New (print)/production/cook-sheet/page.tsx + cook-sheet.css, A4 layout, same window.print()-on-load pattern as the POS receipt.

9 new backend tests (5 service + 4 auth matrix) + 7 new frontend tests, all green. Full suite: 849/851 backend (the 2 failures are the pre-existing, date-dependent Coupon_liability tests already flagged as unrelated in 9ad7fd5), 530/530 frontend.