Add get_current_user_from_token to auth.py; fix missing import in 3 api files

?token= query-param endpoints (PO/invoice print previews, recipe image exports,
backup download) call get_current_user_from_token which was not ported from the
original archive auth module. Added the function and fixed the missing import in
backup.py, ingredients.py, and invoices.py.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/auth.py

@@ -73,6 +73,35 @@ def require_cap(cap: str):
     return checker
 
 
+async def get_current_user_from_token(token: str, db: AsyncSession = None):
+    """Decode a JWT passed as a query-param (e.g. ?token=...) and return a user or None."""
+    try:
+        payload = jwt.decode(token, CENTRAL_AUTH_SECRET, algorithms=[JWT_ALGORITHM])
+    except JWTError:
+        return None
+
+    apps = payload.get("apps", [])
+    if APP_SLUG not in apps:
+        return None
+
+    prefix = f"{APP_SLUG}:"
+    raw_caps = payload.get("caps", [])
+    caps = [c[len(prefix):] for c in raw_caps if isinstance(c, str) and c.startswith(prefix)]
+
+    return SimpleNamespace(
+        id=0,
+        email=payload.get("sub", ""),
+        username=payload.get("sub", ""),
+        name=payload.get("name", ""),
+        display_name=payload.get("name", ""),
+        is_admin=payload.get("is_admin", False),
+        is_active=True,
+        kitchen_id=1,
+        caps=caps,
+        role="admin" if payload.get("is_admin", False) else "user",
+    )
+
+
 async def get_admin_user(user=Depends(get_current_user)):
     if not user.is_admin:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")