Initial kitchen scaffold — Phase 1 kitchen port (build-verified 2026-07-11)

FastAPI backend (Python 3.11, MSSQL ODBC for SambaPOS, Azure DI OCR),
kitchen_db on central PG. React/TS/Vite frontend with navy sidebar layout.

Backend: auth.py (APP_SLUG=kitchen, SimpleNamespace — archive routes use
.kitchen_id/.is_admin without modification), main.py (51 migrations, scheduler,
internal router for KDS bookings feed), api/internal.py, full archive API
(31 routers: invoices, recipes, menus, sambapos, resos, newbook, disputes,
purchase_orders, etc.), models, migrations, OCR pipeline.
kitchen_id pinned to 1 (B1 — single hotel).

Frontend: AuthGate (app=kitchen, token shim for archive compat — B5b pending),
Layout (navy sidebar, 6 sections, Lucide icons, teal --app-primary),
App.tsx (Outlet pattern, UploadApp outside Layout), index.css (full :root block).
strict: false — archive components have type issues; build clean.

Note: 45 archive components call fetch('/api/...') without /kitchen/ prefix
(B5b). Runtime 404s; deferred until after initial testing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/nginx.conf

@@ -0,0 +1,48 @@
+server {
+  listen 80;
+  server_name _;
+
+  # Block internal inter-app endpoints from public access
+  location /kitchen/api/internal/ {
+    return 403;
+  }
+
+  # Central auth proxy — must be before the general /api/ block
+  location /kitchen/api/auth/ {
+    proxy_pass http://10.10.10.101:3001/api/auth/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+
+  # App backend (FastAPI on port 8000)
+  # /kitchen/api/foo → backend:8000/api/foo (prefix preserved)
+  location /kitchen/api/ {
+    proxy_pass http://backend:8000/api/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Cookie $http_cookie;
+    proxy_read_timeout 300s;
+    proxy_connect_timeout 30s;
+    client_max_body_size 20m;
+  }
+
+  # Health
+  location /kitchen/health {
+    proxy_pass http://backend:8000/health;
+  }
+
+  # Static assets — long cache
+  location ~* /kitchen/assets/ {
+    root /usr/share/nginx/html;
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+  }
+
+  # SPA fallback
+  location /kitchen/ {
+    root /usr/share/nginx/html;
+    try_files $uri $uri/ /kitchen/index.html;
+  }
+}