Add phase 5: link import, Instagram fallback and share target

- SSRF-safe fetcher: public IPs only, connects to the checked address,
  redirects re-validated, size/time limits, honest user agent
- schema.org/Recipe JSON-LD extraction (graphs, HowToSections, ISO
  durations, yields, keywords, images) without extra dependencies;
  AI fallback on plain page text when no structured recipe exists
- Instagram: one login-free request to the public embed page; when
  Instagram withholds the caption, the import page explains how to paste
  the text or import a screenshot instead
- Suggested source photo can be downloaded and attached on save
- Text import works without AI (text becomes the description)
- Installable PWA with manifest, icons and Android share target
- Offline tests for SSRF rules, parsers, Instagram and import views

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/test_ai.py

@@ -164,9 +164,19 @@ def test_without_key_ai_is_disabled_but_app_works(settings, user_client):
 
 
 @pytest.mark.django_db
-def test_without_key_imports_give_clear_message(settings, user_client):
+def test_without_key_text_import_becomes_description(settings, user_client):
     settings.OPENAI_API_KEY = ""
-    response = user_client.post(reverse("recipes:import_text"), {"text": "200 g Mehl, 2 Eier, alles verrühren und backen"})
+    text = "200 g Mehl, 2 Eier, alles verrühren und backen"
+    response = user_client.post(reverse("recipes:import_text"), {"text": text})
+    assert "nicht eingerichtet" in response.content.decode()
+    assert response.context["form"].initial["description"] == text
+    assert not Recipe.objects.exists()
+
+
+@pytest.mark.django_db
+def test_without_key_photo_import_gives_clear_message(settings, user_client):
+    settings.OPENAI_API_KEY = ""
+    response = user_client.post(reverse("recipes:import_photo"), {"photos": [image_upload()]}, follow=True)
     assert "nicht eingerichtet" in response.content.decode()