Fix dev-loop breakages and harden the scan API

[HedgehogsGX]

Fixes the things that currently stop a fresh clone from running, plus the backend/frontend rough edges that would bite the first time this is used on a real device.

Frontend install and device reachability

• npm ci failed on npm 11: the lockfile had react-dom@19.2.3 alongside react@19.1.0. Pinned react-dom to 19.1.0 (Expo SDK 54's version); clean installs work again.
• @expo/vector-icons was imported by result.tsx but only present as a nested transitive dependency. Added it as a direct dependency.
• The API URL was hardcoded to localhost, which only works on the iOS simulator. It now resolves EXPO_PUBLIC_API_URL first, then falls back to the host serving the Expo dev bundle (via expo-constants), so a physical phone on the same network reaches python run.py with no config.
• Axios timeout raised 10s → 60s; the first scan downloads OCR models and CPU OCR on a full-res photo comfortably exceeds 10s.
• Server error messages are surfaced in the alert instead of a generic "Failed" string.
• Renamed the app/slug from frontend to AddiGuard/addiguard and added the expo-camera config plugin with a permission string so native iOS builds don't crash on camera access.

Backend

• ScanService() was built at import time, so importing app (including seed.py) loaded torch and the EasyOCR models. The reader is now a cached_property created on the first scan; create_app runs in 0.16s with torch never imported.
• Upload validation: the file must decode as an image (Pillow) → 400 otherwise; MAX_CONTENT_LENGTH is 10 MB → 413. All HTTPExceptions (404, 413, 405…) return JSON.
• 500s no longer echo str(e) to the client; the traceback goes to the app logger and the client gets a fixed message.
• CORS enabled on /api/* so Expo web can call the API.
• debug, PORT and DATABASE_URL come from the environment instead of being hardcoded.
• requirements.txt is pinned and pulls CPU-only torch/torchvision from the PyTorch index (the code runs gpu=False; this avoids ~2 GB of CUDA wheels). Dropped python-Levenshtein (thefuzz 0.22 uses rapidfuzz) and the unused numpy import.
• Deleted backend/app.py, a hello-world duplicate of run.py.

Single source of truth for the traffic light

The frontend re-derived Red/Yellow/Green from risk_score with its own copy of the thresholds and computed the overall label itself, ignoring the traffic_light the API already returned. The API now also returns overall_risk_score and overall_traffic_light; the app renders the traffic_light values it receives through one colour/label map. The detail sheet also shows all four risk factors instead of two.

Mock mode

The toggle is now only rendered in __DEV__ builds, and the capture flow is a single try/finally so the spinner always resets (the old path skipped setScanning(false) in mock mode and used a detached setTimeout).

Tests, CI, README

• backend/tests/: 19 pytest cases covering the risk formula, threshold boundaries, fuzzy matching against OCR-like text (including a typo), lazy reader construction, and every route branch (400/413/500/404, CORS header, overall fields).
• GitHub Actions workflow runs pytest and tsc --noEmit on pushes to main and PRs.
• README now describes what the project does, how to run both halves, the env vars, the API contract and the scoring rule.

Verification

• pytest: 19 passed. npx tsc --noEmit: clean. Fresh npm ci: succeeds.
• End-to-end against the real backend with EasyOCR: posted a synthetic label image ("… Sodium Nitrite, Sodium Benzoate …") to /api/scan; response found both additives, overall_risk_score 0.83 / Red. First call 4.4s including model download, warm call 0.8s. 404/400/413 and CORS preflight verified over HTTP.

Removed frontend/App.tsx.bak and frontend/index.ts.bak.

[capy-ai]

Capy found no issues.

View 6 other findings in Capy.

[capy-ai]

Capy found no issues.

[capy-ai]

Capy found no issues.

View 4 other findings in Capy.