feat: Add SvelteKit web app with scan sessions and import queue

Replaces the Flask/Alpine web app with a SvelteKit 2 + Svelte 5 rewrite
under web/, built on adapter-node and Tailwind v4. Same shape as the
reference b4l budget app — no auth, stateless pass-through to InvenTree.

New "scan session" flow groups mass scans into a session with live
counters (scanned / succeeded / pending / failed). Unknown parts in
import mode are fed to a worker pool that spawns inventree-part-import
(IMPORT_CONCURRENCY, default 3, with 3-retry). Anything that can't be
resolved automatically — parse errors, missing qty, invalid location,
API errors, or imports that exhaust retries — drops into a Failures
panel with a per-item Fix dialog (edit fields / search existing part /
retry import). CSV export on the failure list.

Layout is two-column on lg+: scanner + activity on the left, pending
imports + failures on the right. Light-theme default. SSE on
/api/events streams session and import events to the client.

Barcode parser ported from the Python/JS versions and hardened for
Digi-Key MH10.8.2 barcodes both with and without GS separators (old
parser greedy-matched Q's digits and read "Q6" + "11ZPICK" as 611).
Import worker also now treats a subprocess failure followed by a
successful findPart as a success, so partial imports (part created but
a duplicate parameter trips the DB constraint) no longer land in the
Failures panel.

Deploy artifacts: systemd unit, nginx example (SSE-friendly), and a
step-by-step deploy/README. Requires inventree-part-import >= 1.9.2 on
the server for InvenTree 1.x API compatibility.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/src/routes/api/config/+server.ts

@@ -0,0 +1,13 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { config } from '$lib/server/env';
+import { BARCODE_COMMANDS, MODE_NAMES } from '$lib/types';
+
+export const GET: RequestHandler = () => {
+	return json({
+		host: config.host,
+		modes: MODE_NAMES,
+		barcodeCommands: BARCODE_COMMANDS,
+		importConcurrency: config.importConcurrency
+	});
+};

web/src/routes/api/events/+server.ts

@@ -0,0 +1,13 @@
+import type { RequestHandler } from './$types';
+import { sseStream } from '$lib/server/events';
+
+export const GET: RequestHandler = () => {
+	return new Response(sseStream(), {
+		headers: {
+			'Content-Type': 'text/event-stream',
+			'Cache-Control': 'no-cache, no-transform',
+			Connection: 'keep-alive',
+			'X-Accel-Buffering': 'no'
+		}
+	});
+};

web/src/routes/api/locations/+server.ts

@@ -0,0 +1,13 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { getLocations } from '$lib/server/inventree';
+
+export const GET: RequestHandler = async () => {
+	try {
+		const locations = await getLocations();
+		return json({ locations });
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : String(e);
+		error(502, msg);
+	}
+};

web/src/routes/api/part/search/+server.ts

@@ -0,0 +1,19 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { searchParts } from '$lib/server/inventree';
+
+export const POST: RequestHandler = async ({ request }) => {
+	const { query, limit } = (await request.json().catch(() => ({}))) as {
+		query?: string;
+		limit?: number;
+	};
+	if (!query) error(400, 'query required');
+
+	try {
+		const results = await searchParts(query, limit ?? 10);
+		return json({ results });
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : String(e);
+		error(502, msg);
+	}
+};

web/src/routes/api/proxy/image/+server.ts

@@ -0,0 +1,21 @@
+import { error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { fetchImage } from '$lib/server/inventree';
+
+export const GET: RequestHandler = async ({ url }) => {
+	const target = url.searchParams.get('url');
+	if (!target) error(400, 'url parameter required');
+
+	try {
+		const { body, contentType } = await fetchImage(target);
+		return new Response(body, {
+			headers: {
+				'Content-Type': contentType,
+				'Cache-Control': 'private, max-age=300'
+			}
+		});
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : String(e);
+		error(502, msg);
+	}
+};

web/src/routes/api/session/end/+server.ts

@@ -0,0 +1,11 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { endSession } from '$lib/server/sessions';
+
+export const POST: RequestHandler = async ({ request }) => {
+	const { sessionId } = (await request.json().catch(() => ({}))) as { sessionId?: string };
+	if (!sessionId) error(400, 'sessionId required');
+	const session = endSession(sessionId);
+	if (!session) error(404, 'session not found');
+	return json({ session });
+};

web/src/routes/api/session/failures/+server.ts

@@ -0,0 +1,22 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { dismissFailure, getSession } from '$lib/server/sessions';
+
+export const GET: RequestHandler = ({ url }) => {
+	const sessionId = url.searchParams.get('sessionId');
+	if (!sessionId) error(400, 'sessionId required');
+	const session = getSession(sessionId);
+	if (!session) error(404, 'session not found');
+	return json({ failures: session.failures });
+};
+
+export const DELETE: RequestHandler = async ({ request }) => {
+	const { sessionId, failureId } = (await request.json().catch(() => ({}))) as {
+		sessionId?: string;
+		failureId?: string;
+	};
+	if (!sessionId || !failureId) error(400, 'sessionId and failureId required');
+	const session = dismissFailure(sessionId, failureId);
+	if (!session) error(404, 'session not found');
+	return json({ session });
+};

web/src/routes/api/session/location/+server.ts

@@ -0,0 +1,14 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { updateSessionLocation } from '$lib/server/sessions';
+
+export const POST: RequestHandler = async ({ request }) => {
+	const { sessionId, locationId } = (await request.json().catch(() => ({}))) as {
+		sessionId?: string;
+		locationId?: number | null;
+	};
+	if (!sessionId) error(400, 'sessionId required');
+	const session = updateSessionLocation(sessionId, locationId ?? null);
+	if (!session) error(404, 'session not found');
+	return json({ session });
+};

web/src/routes/api/session/mode/+server.ts

@@ -0,0 +1,18 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { updateSessionMode } from '$lib/server/sessions';
+import type { ScanMode } from '$lib/types';
+
+const VALID: ScanMode[] = ['import', 'update', 'get', 'locate'];
+
+export const POST: RequestHandler = async ({ request }) => {
+	const { sessionId, mode } = (await request.json().catch(() => ({}))) as {
+		sessionId?: string;
+		mode?: ScanMode;
+	};
+	if (!sessionId) error(400, 'sessionId required');
+	if (!mode || !VALID.includes(mode)) error(400, 'valid mode required');
+	const session = updateSessionMode(sessionId, mode);
+	if (!session) error(404, 'session not found');
+	return json({ session });
+};

web/src/routes/api/session/retry/+server.ts

@@ -0,0 +1,21 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { retryFailure, getSession, type RetryFixes } from '$lib/server/sessions';
+
+export const POST: RequestHandler = async ({ request }) => {
+	const body = (await request.json().catch(() => ({}))) as {
+		sessionId?: string;
+		failureId?: string;
+		fixes?: RetryFixes;
+	};
+	if (!body.sessionId) error(400, 'sessionId required');
+	if (!body.failureId) error(400, 'failureId required');
+
+	try {
+		const outcome = await retryFailure(body.sessionId, body.failureId, body.fixes ?? {});
+		return json({ outcome, session: getSession(body.sessionId) });
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : String(e);
+		error(400, msg);
+	}
+};

web/src/routes/api/session/scan/+server.ts

@@ -0,0 +1,30 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { processScan, getSession } from '$lib/server/sessions';
+
+export const POST: RequestHandler = async ({ request }) => {
+	const body = (await request.json().catch(() => ({}))) as {
+		sessionId?: string;
+		rawBarcode?: string;
+		partCode?: string | null;
+		quantity?: number | null;
+		locationId?: number | null;
+		partId?: number | null;
+	};
+	if (!body.sessionId) error(400, 'sessionId required');
+	if (body.rawBarcode == null) error(400, 'rawBarcode required');
+
+	try {
+		const outcome = await processScan(body.sessionId, {
+			rawBarcode: body.rawBarcode,
+			partCode: body.partCode ?? null,
+			quantity: body.quantity ?? null,
+			locationId: body.locationId ?? null,
+			partId: body.partId ?? null
+		});
+		return json({ outcome, session: getSession(body.sessionId) });
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : String(e);
+		error(400, msg);
+	}
+};

web/src/routes/api/session/start/+server.ts

@@ -0,0 +1,21 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { createSession } from '$lib/server/sessions';
+import type { ScanMode } from '$lib/types';
+
+const VALID_MODES: ScanMode[] = ['import', 'update', 'get', 'locate'];
+
+export const POST: RequestHandler = async ({ request }) => {
+	const body = (await request.json().catch(() => ({}))) as {
+		mode?: ScanMode;
+		locationId?: number | null;
+	};
+	const mode = body.mode ?? 'import';
+	if (!VALID_MODES.includes(mode)) error(400, `invalid mode: ${mode}`);
+
+	const session = createSession({
+		mode,
+		locationId: body.locationId ?? null
+	});
+	return json({ session });
+};