fix: use modern /food/add endpoint for diary writes

[sverrejoh]

Fix: use modern /food/add endpoint for diary writes

Summary

add_food_to_diary() (and therefore the mfp_add_food_to_diary MCP tool)
currently writes nothing. The legacy endpoint it targets — POST /food/diary/{username}/add —
was removed from MyFitnessPal and now returns 404. Every write attempt looks
successful (no exception) but the diary never receives the entry.

This PR rewrites the function to use MFP's current POST /food/add endpoint,
discovered by capturing a real "Add Food to Diary" browser submission via Playwright.

The bug, reproduced

Tested on June 4, 2026 with a freshly authenticated session
(__Secure-next-auth.session-token cookie, fully populated Rails session cookies
including _mfp_session, remember_me, known_user):

GET  https://www.myfitnesspal.com/food/diary/{user}/add  → 404
POST https://www.myfitnesspal.com/food/diary/{user}/add  → 404

The MCP tool returns generic "Failed to add food to diary" but the diary on the
subsequent read has zero matching entries.

The new endpoint

Captured by Playwright submitting the visible Add Food form:

POST /food/add
  authenticity_token=<from search-results page>
  food_entry[food_id]=<data-original-id, NOT mfp_id>
  food_entry[date]=YYYY-MM-DD
  food_entry[quantity]=<servings>
  food_entry[weight_id]=<first data-weight-ids value>
  food_entry[meal_id]=0|1|2|3

Headers:
  X-CSRF-Token: <meta name="csrf-token" content="...">
  Referer:      https://www.myfitnesspal.com/food/search
  (X-Requested-With must NOT be set; that triggers 302 → /account/login)

Two key differences from the legacy contract:

1. food_entry[food_id] is data-original-id, not mfp_id. They are different IDs.
   The MFP search results expose both:
   • data-external-id="23647715544933" ← matches mfp_id from mfp_search_food
   • data-original-id="1501419233" ← the value /food/add expects
2. food_entry[meal_id], not meal is the field name for meal selection.

How the rewritten function works

1. Warm the session: visit /food/diary (populates Rails session cookies).
2. GET /food/add_to_diary?meal=<index> to get an initial authenticity_token.
3. Resolve the food's name via client.get_food_item_details(mfp_id),
   then POST /food/search to surface a result row with data-original-id and
   data-weight-ids.
4. POST /food/add with the modern field structure, the meta X-CSRF-Token
   header, and Referer: /food/search.

A 302 to /food/diary/* confirms success. A 302 to /account/login indicates
the session is missing/expired, and a non-redirect response is treated as
failure.

Additional fix

AddFoodToDiaryInput.quantity previously had le=100, which blocked any
gram-quantity entry larger than 100 g — e.g. "200 g cottage cheese",
"109 g ham", "150 g rice" — all common cases. Raised to le=10000.

Verification

Adding 5 foods (109 g ham, 57 g bread, 5 g butter, 43 g cucumber,
200 g cottage cheese, 1 medium orange) via the patched mfp_add_food_to_diary:

• All 5 calls return {"success": true, ...}
• Subsequent mfp_get_diary shows all 5 entries with correct quantities,
  units, and nutrition totals
• Day total moves from 474 cal → 1148 cal as expected

The original code on the same session and food IDs persists 0 entries.

---

🤖 This patch was developed and verified by Claude by reverse-engineering the live site
behavior with Playwright. The original test transcript (failure proofs + new
endpoint discovery + post-fix verification) is available on request.

[sverrejoh]

Added a second commit: feat: add mfp_remove_food_from_diary tool.

Same investigation pattern as the write fix — used Playwright to find that each diary entry row exposes its food_entry_id via <a data-food-entry-id="…" class="js-show-edit-food">, and the delete is:

DELETE /food/remove/{food_entry_id}
  X-CSRF-Token: <meta name="csrf-token" content>
  Referer: https://www.myfitnesspal.com/food/diary

The new MCP tool supports two modes:

• By entry_id — precise deletion when the ID is known
• By name_contains + optional meal — fuzzy substring match, capped by max_matches (default 1)

Round-trip verified through the MCP tools: add → get_diary (visible) → remove → get_diary (gone).

Happy to split this into a separate PR if you'd prefer the fix and the feature reviewed independently — just say the word.