fix(review): validar raciones/items, upsert por id (no duplicar), escape LIKE, clamp limit, 404, dedupe en 1 query

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_api.py

@@ -33,6 +33,27 @@ def test_search_imports_from_off(monkeypatch):
     assert any(f["name"] == "Cosa OFF" for f in res)
 
 
+def test_food_upsert_by_id_no_duplicates():
+    r1 = client.post("/foods", json={"id": "fixed-1", "name": "Salsa X", "kcalPer100g": 100})
+    assert r1.json()["id"] == "fixed-1"
+    client.post("/foods", json={"id": "fixed-1", "name": "Salsa X v2", "kcalPer100g": 110})
+    res = client.get("/foods", params={"q": "salsa x"}).json()
+    matches = [f for f in res if f["id"] == "fixed-1"]
+    assert len(matches) == 1
+    assert matches[0]["kcalPer100g"] == 110  # actualizado, no duplicado
+
+
+def test_food_rejects_malformed_portion():
+    r = client.post("/foods", json={
+        "name": "Mala", "kcalPer100g": 50, "portions": [{"name": "taza"}]  # falta grams
+    })
+    assert r.status_code == 422  # pydantic valida la forma
+
+
+def test_get_missing_recipe_is_404():
+    assert client.get("/recipes/nope").status_code == 404
+
+
 def test_publish_and_get_recipe():
     r = client.post("/recipes", json={
         "name": "Ensalada",