Initial kitchen scaffold — Phase 1 kitchen port (build-verified 2026-07-11)

FastAPI backend (Python 3.11, MSSQL ODBC for SambaPOS, Azure DI OCR),
kitchen_db on central PG. React/TS/Vite frontend with navy sidebar layout.

Backend: auth.py (APP_SLUG=kitchen, SimpleNamespace — archive routes use
.kitchen_id/.is_admin without modification), main.py (51 migrations, scheduler,
internal router for KDS bookings feed), api/internal.py, full archive API
(31 routers: invoices, recipes, menus, sambapos, resos, newbook, disputes,
purchase_orders, etc.), models, migrations, OCR pipeline.
kitchen_id pinned to 1 (B1 — single hotel).

Frontend: AuthGate (app=kitchen, token shim for archive compat — B5b pending),
Layout (navy sidebar, 6 sections, Lucide icons, teal --app-primary),
App.tsx (Outlet pattern, UploadApp outside Layout), index.css (full :root block).
strict: false — archive components have type issues; build clean.

Note: 45 archive components call fetch('/api/...') without /kitchen/ prefix
(B5b). Runtime 404s; deferred until after initial testing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/internal.py

@@ -0,0 +1,64 @@
+"""
+Internal API — endpoints consumed by other stack apps (not public).
+nginx denies /kitchen/api/internal/ from the public side; these endpoints
+are called directly on the backend port (8000) from within the docker bridge.
+"""
+from datetime import date
+from typing import Optional
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
+
+from database import get_db
+from auth import verify_internal_secret
+from models.resos import ResosBooking
+
+router = APIRouter()
+
+
+@router.get("/api/internal/resos/bookings")
+async def internal_resos_bookings(
+    booking_date: Optional[str] = Query(None, alias="date"),
+    _: None = Depends(verify_internal_secret),
+    db: AsyncSession = Depends(get_db),
+):
+    """
+    Cached ResOS bookings for a given date — consumed by the KDS app bookings screen.
+    KDS calls: GET http://10.10.10.110:8000/api/internal/resos/bookings?date=YYYY-MM-DD
+    Authorization: Bearer {STACK_INTERNAL_SECRET}
+    """
+    try:
+        target_date = date.fromisoformat(booking_date) if booking_date else date.today()
+    except (ValueError, TypeError):
+        raise HTTPException(status_code=400, detail="Invalid date format — use YYYY-MM-DD")
+
+    result = await db.execute(
+        select(ResosBooking)
+        .where(
+            ResosBooking.kitchen_id == 1,
+            ResosBooking.booking_date == target_date,
+        )
+        .order_by(ResosBooking.booking_time)
+    )
+    bookings = result.scalars().all()
+
+    return [
+        {
+            "id": b.id,
+            "resos_booking_id": b.resos_booking_id,
+            "booking_date": b.booking_date.isoformat(),
+            "booking_time": b.booking_time.strftime("%H:%M"),
+            "people": b.people,
+            "status": b.status,
+            "seating_area": b.seating_area,
+            "table_name": b.table_name,
+            "hotel_booking_number": b.hotel_booking_number,
+            "is_hotel_guest": b.is_hotel_guest,
+            "is_dbb": b.is_dbb,
+            "allergies": b.allergies,
+            "notes": b.notes,
+            "opening_hour_name": b.opening_hour_name,
+        }
+        for b in bookings
+    ]