Schritt 1: Fundament der Lebensmittel-Lagerverwaltung (Pantry)

Backend (FastAPI + PostgreSQL): Chargen mit MHD, FEFO-Auslagern,
Einheiten-Umrechnung (Stueck/g/ml + Packungen), Open-Food-Facts-Lookup
mit lokalem Fallback, JWT-Auth mit Rollen (Admin/Nutzer), erster Admin
beim Setup, Einkaufsliste, Ablaufwarnung, Lagerorte, pytest fuer FEFO.

Web-UI (React/Vite): Login, Dashboard, Ein-/Auslagern, Produkte,
Lagerorte, Benutzerverwaltung, Einkaufsliste - rollenabhaengig.

Deploy: docker-compose + install.sh (Docker-Autoinstall, Secrets),
README und Roadmap fuer Schritt 2 (iOS) und Schritt 3.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/routers/products.py

@@ -0,0 +1,125 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.orm import Session
+
+from ..crud import product_to_out
+from ..database import get_db
+from ..deps import get_current_user, require_admin
+from ..models import BaseUnit, Product, User
+from ..off import lookup_barcode
+from ..schemas import LookupResult, ProductCreate, ProductOut, ProductUpdate
+
+router = APIRouter(prefix="/products", tags=["products"])
+
+
+@router.get("", response_model=list[ProductOut])
+def list_products(
+    q: str | None = None,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> list[ProductOut]:
+    query = db.query(Product)
+    if q:
+        like = f"%{q}%"
+        query = query.filter(Product.name.ilike(like))
+    products = query.order_by(Product.name).all()
+    return [product_to_out(db, p) for p in products]
+
+
+@router.get("/lookup", response_model=LookupResult)
+def lookup(
+    barcode: str,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> LookupResult:
+    """Barcode: erst lokal, dann Open Food Facts. Nur Vorschlag, legt nichts an."""
+    existing = db.query(Product).filter(Product.barcode == barcode).first()
+    if existing:
+        return LookupResult(found=True, existing_product=product_to_out(db, existing))
+
+    suggestion = lookup_barcode(barcode)
+    if suggestion:
+        return LookupResult(found=True, suggestion=suggestion)
+    return LookupResult(found=False)
+
+
+@router.get("/{product_id}", response_model=ProductOut)
+def get_product(
+    product_id: int,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> ProductOut:
+    product = db.get(Product, product_id)
+    if product is None:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "Produkt nicht gefunden")
+    return product_to_out(db, product)
+
+
+@router.post("", response_model=ProductOut, status_code=status.HTTP_201_CREATED)
+def create_product(
+    payload: ProductCreate,
+    db: Session = Depends(get_db),
+    _: User = Depends(require_admin),
+) -> ProductOut:
+    if payload.barcode:
+        exists = db.query(Product).filter(Product.barcode == payload.barcode).first()
+        if exists:
+            raise HTTPException(
+                status.HTTP_409_CONFLICT, "Ein Produkt mit diesem Barcode existiert bereits"
+            )
+    product = Product(
+        barcode=payload.barcode or None,
+        name=payload.name,
+        brand=payload.brand,
+        image_url=payload.image_url,
+        base_unit=payload.base_unit,
+        package_size=payload.package_size,
+        group_id=payload.group_id,
+        min_stock=payload.min_stock,
+        source="manual",
+    )
+    db.add(product)
+    db.commit()
+    db.refresh(product)
+    return product_to_out(db, product)
+
+
+@router.patch("/{product_id}", response_model=ProductOut)
+def update_product(
+    product_id: int,
+    payload: ProductUpdate,
+    db: Session = Depends(get_db),
+    _: User = Depends(require_admin),
+) -> ProductOut:
+    product = db.get(Product, product_id)
+    if product is None:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "Produkt nicht gefunden")
+
+    data = payload.model_dump(exclude_unset=True)
+    if "barcode" in data and data["barcode"]:
+        clash = (
+            db.query(Product)
+            .filter(Product.barcode == data["barcode"], Product.id != product_id)
+            .first()
+        )
+        if clash:
+            raise HTTPException(
+                status.HTTP_409_CONFLICT, "Ein anderes Produkt hat diesen Barcode bereits"
+            )
+    for field, value in data.items():
+        setattr(product, field, value)
+    db.commit()
+    db.refresh(product)
+    return product_to_out(db, product)
+
+
+@router.delete("/{product_id}", status_code=status.HTTP_204_NO_CONTENT)
+def delete_product(
+    product_id: int,
+    db: Session = Depends(get_db),
+    _: User = Depends(require_admin),
+) -> None:
+    product = db.get(Product, product_id)
+    if product is None:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "Produkt nicht gefunden")
+    db.delete(product)
+    db.commit()