Add staff dietary-per-day report + data-freshness controls

The real report: dietary information per day for funktionärer, ledar-
funktionärer, and medföljande barn, read from the Scoutnet staff +
participants projects.

Domain (src/reports/staff-dietary/):
- constants.ts — question/choice tables hardcoded from the live forms
  (staff 43853, child 43854, participant 43844).
- populations.ts — classify staff (fee 32207) / child (32359, guest 32810
  ignored) / leader-staff (participants fee 32348 or checkbox 89316); dedupe
  by member_no, priority staff > leader > child.
- presence.ts — staff/child period model (union of selected periods minus
  excluded days; child 91058 is positive attend-days); leader-staff fixed
  25 Jul–1 Aug.
- diet.ts — allergens/preferences unified by label across both form schemas;
  section gates; consent (90424) gates diet only for leader-staff.
- core.ts (server-only) + report.ts / export.ts (server-fn entry points).

UI (reports.staff-dietary.tsx):
- Deltagartyper (all selected by default), check-in, day range picker, and a
  staff-only "confirmed dates" (111761) filter; per-person matrix with sticky
  name column, member no, per-diet and per-day (Ja/blank) columns; summary tab
  with per-day headcount + diet counts reflecting filters.
- CSV/XLSX export (node-xlsx), timestamped filename; download requires a
  sensitive-data acknowledgement dialog.
- "Senast uppdaterad" + manual refresh button.

Infra:
- Scoutnet cache is now stale-while-revalidate (15-min TTL) with fetchedAt
  tracking; only the first cold request blocks.
- Router-level pending component so slow report loaders show a spinner.
- CI workflow to build/push the Docker image.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: scriptcoded

.github/workflows/build-image.yml

@@ -0,0 +1,67 @@
+name: Build Docker Image
+
+on:
+  push:
+  release:
+    types: [published]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+concurrency:
+  group: build-image-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=semver,pattern={{version}}
+
+      - name: Build and push
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          platforms: linux/amd64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

CLAUDE.md

@@ -42,19 +42,31 @@ Project API — **owns no data, has no database.**
    MUI render, `useAppBarTitle(...)`).
 3. Link it from `src/routes/_authenticated/index.tsx`.
 
-## Future work — the real "staff dietary info per day" report
-
-Not built yet. Known complexity to respect when building it:
-- **Days are layered & population-specific.** Presence per day is a multi-select
-  answer, but earlier form questions let people opt out of specific days, and the
-  calculation differs for **staff vs participants vs child-of-staff** (child-of-
-  staff live in the staff project under a different fee + form). Compute per
-  population kind (`project.kind` + fee).
-- **Diet data is consent-gated & sensitive.** Reuse the question-ID map and
-  consent gating from `j26-signupinfo/pyapp/app/scoutnet_forms.py`
-  (`_j26_question_hack_individual`): consent flags `90424`/`90433`, allergies
-  `88199`, preferences `89292`, extra-restricted `88206`, health section `21334`.
-  Apply role-based redaction. `data.ts` should expose the raw `questions` map for
-  the report to decode.
-- The current staff-roster report deliberately touches none of this — only
-  `name` / `fee` / `checked_in`.
+## Reports
+
+- **staff-roster** (`src/reports/staff-roster/`) — trivial proof-of-concept:
+  merged roster across both projects, check-in filter. Touches only
+  `name`/`fee`/`checked_in`.
+- **staff-dietary** (`src/reports/staff-dietary/`) — the real dietary-per-day
+  report. Module layout:
+  - `constants.ts` — all hardcoded question/choice tables, taken from the live
+    form defs (staff 43853, child 43854, participant 43844). Regenerate via the
+    discovery script if forms change.
+  - `values.ts` — defensive readers (multiselect = **array** of option ids,
+    boolean = `"0"`/`"1"`, text = string).
+  - `populations.ts` — classify `staff`(fee 32207) / `child`(32359, ignore guest
+    32810) from the staff project; `leader-staff` from participants (fee 32348
+    **or** checkbox `89316`). Dedupe by `member_no`, priority staff>leader>child.
+  - `presence.ts` — staff/child period model: `presentDays = ⋃(selected-period
+    days) − ⋃(absence days of checked periods)`; **child `91058` is positive**
+    (attend-days, not absence); leader-staff fixed **25 Jul–1 Aug**.
+  - `diet.ts` — allergens/prefs unified by Swedish label across the two form
+    schemas; section gates; consent `90424` gates diet **only for leader-staff**
+    (staff/child forms have no consent question).
+  - `core.ts` — server-only orchestration (`runStaffDietaryReport`): fetch →
+    classify → dedupe → presence+diet → filter → aggregates. **Not** a server fn,
+    so both `report.ts` and `export.ts` reuse it.
+  - `report.ts` / `export.ts` — the `createServerFn` entry points (auth-gated).
+    Keep server-only imports (data/cache/node:fs, node-xlsx) reachable **only**
+    through a server-fn handler or `core.ts`; a plain exported fn that pulls them
+    into a client-imported module breaks the browser build.

package.json

@@ -31,6 +31,7 @@
     "dayjs": "^1.11.20",
     "jose": "^6.2.2",
     "nitro": "npm:nitro-nightly@latest",
+    "node-xlsx": "^0.24.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0"
   },

pnpm-lock.yaml

@@ -0,0 +1,24 @@
+import { Box, CircularProgress, Typography } from "@mui/material";
+
+/**
+ * Shown while a report loader is running. The first cold request fetches the
+ * full participants project from Scoutnet (~15s); after that the cache serves
+ * instantly, so this is mostly seen once per server lifetime.
+ */
+export function PendingReport() {
+	return (
+		<Box
+			display="flex"
+			flexDirection="column"
+			alignItems="center"
+			justifyContent="center"
+			gap={2}
+			minHeight="40vh"
+		>
+			<CircularProgress />
+			<Typography variant="body2" color="text.secondary">
+				Hämtar data från Scoutnet…
+			</Typography>
+		</Box>
+	);
+}