Matching users by email alone allows an attacker with a self-registered
Nextcloud account to hijack any Filament user. Now we look up by
nextcloud_id first; email is only used when creating a brand-new account,
and nextcloud_id is immediately written to the row so future logins
use the stable Nextcloud user ID.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Each spice now returns an `origins` array (was single `origin` object) with
supplier and farmer resolved from the new entries relation, not flat columns.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Route changed to /api/v1/{lot_number}. LotResource now includes
packing details, units_produced, quantity_g and recipe version.
CORS config added for public API access. README documents the
endpoint, example response and subdomain setup instructions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
/shopify/install → redirects to Shopify OAuth
/shopify/callback → exchanges code for access token and displays it
To be removed after token is captured.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
