Pantry: barcode scanning with several barcodes per item, a Take one screen for everyone including children, and no longer tied to Mealie

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

server.js

@@ -48,6 +48,7 @@ const contacts = require('./contacts');   // each person's address book (mail su
 const activity = require('./activity'), alertParents = activity.alertParents;
 const kidlimits = require('./kidlimits'); // child accounts: a daily time limit and bedtime, and asking a parent for more time
 const screentime = require('./screentime'); // fewer web addresses for iPad Screen Time: a report-only policy, the list of what devices reached, and a picture pass-through
+const pantry = require('./pantry');       // the family pantry, with barcode scanning
 const automations = require('./automations'); // when this happens, do that (per person)
 const moviefam = require('./moviefam');   // Movies & TV: favorites and the family's movie night list
 const chores = require('./chores');       // chores for the family, with points
@@ -586,6 +587,7 @@ const ACCESS = [
   [/^\/api\/bible\//, ['bible']],
   [/^\/api\/read\//, ['read']],
   [/^\/api\/radio\//, ['radio']],
+  [/^\/api\/pantry(\/|$)/, ['recipes']],
   [/^\/api\/moviefam(\/|$)/, ['video']],
   [/^\/api\/chores(\/|$)/, ['chores']],
   [/^\/api\/notes(\/|$)/, ['notes']],
@@ -612,7 +614,7 @@ function securityHeaders(res) {
   res.setHeader('Referrer-Policy', 'same-origin');
   res.setHeader('Content-Security-Policy', "frame-ancestors 'self'; base-uri 'self'; object-src 'none'; form-action 'self'");
   res.setHeader('Content-Security-Policy-Report-Only', screentime.policy()); // (reports only: nothing is blocked)
-  res.setHeader('Permissions-Policy', 'camera=(), geolocation=(), payment=()');
+  res.setHeader('Permissions-Policy', 'camera=(self), geolocation=(), payment=()');
   if (process.env.PUBLIC_URL && process.env.PUBLIC_URL.startsWith('https://')) res.setHeader('Strict-Transport-Security', 'max-age=15552000');
 }
 /** Cross-site request check: a browser request that changes something must come from this same site. */
@@ -716,6 +718,7 @@ async function handleRequest(req, res) {
     if (pathname === '/api/kid/requests' || pathname.startsWith('/api/kid/requests/')) return require('./requests').handle(req, res, user);
     if (pathname.startsWith('/api/kid/')) return kidlimits.handle(req, res, user, { askParents: chat.askParents });
     if (pathname === '/api/csp-report' || pathname === '/api/img' || pathname === '/api/screentime') return screentime.handle(req, res, user);
+    if (pathname === '/api/pantry' || pathname.startsWith('/api/pantry/')) return pantry.handle(req, res);
     if (pathname === '/api/auto' || pathname.startsWith('/api/auto/')) return automations.handle(req, res);
     if (pathname === '/api/moviefam' || pathname.startsWith('/api/moviefam/')) return moviefam.handle(req, res);
     if (pathname === '/api/chores' || pathname.startsWith('/api/chores/')) return chores.handle(req, res);