groceries: add Picnic store (picnic.app storefront API, full range via category pages)

- picnic.ts: crawls the category tree, subcategory and overview pages (RSC), maps
  Picnic categories to the shared list; no EANs, so matching is by name/brand/size
- picnic-auth.ts + scripts/picnic-login.ts: one-shot login from
  /etc/grocery-tracker/picnic.env, token kept in ~/.config/groceries/picnic.env;
  2FA is never requested unattended (run picnic-login.ts by hand)
- migration: store row picnic; Picnic as own brand in stats

drizzle/20261027090223_groceries_store_picnic/migration.sql

@@ -0,0 +1,4 @@
+-- Picnic (picnic.app, app-only delivery supermarket).
+INSERT INTO "groceries"."stores" ("slug", "name", "website", "color", "sort_order") VALUES
+	('picnic', 'Picnic', 'https://picnic.app/nl/', '#e1171e', 120)
+ON CONFLICT ("slug") DO NOTHING;