Audit pass: cookie auth migration, route guards, GP% clamp, CSV export, OCR transaction safety, N+1 fix, and cleanup

- Migrated all 435 frontend fetch calls from Authorization Bearer header to credentials: 'include' (cookie auth)
- Removed ?token= from all file/image URLs (browser history exposure)
- Added ProtectedRoute wrapper to all capability-gated routes in App.tsx
- OCR background task: added transaction boundary, improved error handling and status rollback
- DuplicateDetector: wrapped in non-fatal try/except so crashes don't abort invoice processing
- File upload: commit DB row before writing to disk to prevent orphaned files
- GP% clamped to 100% in GPReport (credit notes can inflate above 100%)
- Added CSV export to GPReport (suppliers, daily data, allowances breakdown)
- Backend file-serving endpoints: cookie auth with ?token= fallback for backward compatibility
- DATA_DIR: moved from hardcoded /app/data to os.getenv in invoices.py and recipes.py
- N+1 fix in list_recipes: batch-loads latest cost snapshot in 1 query (was N)
- Zero-yield sub-recipe: logs warning instead of silently zeroing cost contribution
- Budget spend rate input: rejects negative values
- GPReport allowances toggle: persisted to localStorage across page loads
- DB pool_size/max_overflow: configurable via DB_POOL_SIZE/DB_MAX_OVERFLOW env vars
- Fixed SyntaxWarning from \\d in invoices.py docstring

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/purchase_orders.py

@@ -10,7 +10,7 @@ from decimal import Decimal
 from typing import Optional
 from html import escape as html_escape
 
-from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Query
+from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Query, Request
 from fastapi.responses import HTMLResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select, and_, or_, func, delete
@@ -661,13 +661,19 @@ def _build_po_html(po: PurchaseOrder, kitchen: KitchenSettings, currency: str =
 @router.get("/{po_id}/preview")
 async def preview_purchase_order(
     po_id: int,
-    token: Optional[str] = None,
+    request: Request,
+    token: Optional[str] = Query(None),
     db: AsyncSession = Depends(get_db),
 ):
-    """Return a print-friendly HTML preview of the purchase order (query-param auth)."""
-    if not token:
-        raise HTTPException(status_code=401, detail="Token required — use ?token=your_jwt_token")
-    current_user = await get_current_user_from_token(token, db)
+    """Return a print-friendly HTML preview of the purchase order. Cookie auth preferred; ?token= accepted as fallback."""
+    current_user = None
+    if token:
+        current_user = await get_current_user_from_token(token, db)
+    if not current_user:
+        try:
+            current_user = await get_current_user(request)
+        except HTTPException:
+            pass
     if not current_user:
         raise HTTPException(status_code=401, detail="Not authenticated")
     po = await _load_po(db, po_id, current_user.kitchen_id)