Initial KDS scaffold — Phase 2 kitchen port

FastAPI backend (Python 3.11, httpx for SignalR/GraphQL — no MSSQL ODBC),
shares kitchen_db directly. React/TS/Vite fullscreen board frontend.

Backend: auth.py (APP_SLUG=kds, SimpleNamespace), main.py (4 KDS migrations,
SignalR start/stop), kds.py router, models (kds/settings/resos — read from
kitchen_db), signalr_listener.py (backoff pre-existing), kds_graphql.py,
database.py. Requirements stripped to ~9 packages; image ~400 MB lighter
than kitchen (no MSSQL ODBC layer).

Frontend: AuthGate (app=kds), single fullscreen route, dark board theme.
KDS.tsx URL prefix patched (/api/kds/ → /kds/api/kds/),
recipe images cross-app (/kitchen/api/recipes/).
nginx: 5 blocks with SSE proxy headers on /kds/api/ block.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/auth.py

@@ -0,0 +1,63 @@
+import os
+from types import SimpleNamespace
+
+from fastapi import Depends, HTTPException, Request, status
+from jose import JWTError, jwt
+
+CENTRAL_AUTH_SECRET = os.getenv("CENTRAL_AUTH_SECRET", "")
+JWT_ALGORITHM = "HS256"
+APP_SLUG = os.getenv("APP_SLUG", "kds")
+
+
+async def get_current_user(request: Request):
+    """
+    Verify the stack hnf_session cookie.
+    Returns a SimpleNamespace so archive kds.py can use current_user.kitchen_id,
+    current_user.is_admin, etc. without modification. kitchen_id is pinned to 1.
+    """
+    token = request.cookies.get("hnf_session")
+    if not token:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authenticated")
+
+    try:
+        payload = jwt.decode(token, CENTRAL_AUTH_SECRET, algorithms=[JWT_ALGORITHM])
+    except JWTError:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid session")
+
+    apps = payload.get("apps", [])
+    if APP_SLUG not in apps:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="No permission for this app")
+
+    prefix = f"{APP_SLUG}:"
+    raw_caps = payload.get("caps", [])
+    caps = [c[len(prefix):] for c in raw_caps if isinstance(c, str) and c.startswith(prefix)]
+
+    is_admin = payload.get("is_admin", False)
+
+    return SimpleNamespace(
+        id=0,
+        email=payload.get("sub", ""),
+        username=payload.get("sub", ""),
+        name=payload.get("name", ""),
+        display_name=payload.get("name", ""),
+        is_admin=is_admin,
+        is_active=True,
+        kitchen_id=1,
+        caps=caps,
+        role="admin" if is_admin else "user",
+    )
+
+
+def has_cap(user, cap: str) -> bool:
+    return user.is_admin or cap in user.caps
+
+
+def require_cap(cap: str):
+    async def checker(user=Depends(get_current_user)):
+        if not has_cap(user, cap):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=f"Missing capability: {cap}",
+            )
+        return user
+    return checker