v1.0.0-rc.21

New Features

• Recipe yields. Recipes can now declare how many servings they make. Set "Yields" in the recipe editor and adding one serving to the diary uses per-serving weight + nutrition. Existing recipes keep their old behavior until you set a yields value.
• Per-serving Open Food Facts import. New option in Settings → Connected Services → Open Food Facts → Import Portion As. When set to Per Serving, barcode scans and OFF searches prefill the food with per-serving values whenever the product has serving data on OFF.
• Intermittent Fasting tracker. Track fasts from a Diary widget: default goal, last-fast hint, named custom-hour presets, history with delete, and a recurring schedule that auto-starts a fast on chosen days at a chosen time. Tap the start time on an active fast to edit it inline.
• Android biometric sign-in. Fingerprint and face unlock for the Android app in server-connected mode. Toggle in Profile.
• Adaptive TDEE. Calorie Goals can learn your true daily energy expenditure from a rolling 35-day window of weight and diary trend, instead of the static Harris-Benedict estimate.

Improvements

• Settings forms use sliding-pill segmented controls. Goals section renamed to Calorie Goals.
• Sharing rework: per-category sharing form, source filter on Meals/Recipes, and read-only editors when viewing someone else's shared food.
• User management: invite by email, revoke pending invites, block invites to existing accounts. Optional zxcvbn-backed password strength policy.
• Wizard summary clarifies the TDEE label and shows the goal-factor math.
• Android local-only mode reaches feature parity with server mode for Adaptive TDEE and the Fasting tracker.
• AI Assistant (Trace) gains two new tools: get_adaptive_tdee and get_activity_log.
• INSECURE_COOKIES env var is now documented in .env.example and the README env-vars table. Required for self-hosters on plain HTTP without TLS in front.

Fixes

• Wrong food images in the diary (cross-pollination across foods that share an Open Food Facts basename). Diary images are now live-resolved from the current foods and meals tables on every read, routed by recipe vs food, and disambiguated by brand.
• Duplicate food rows when scanning the same barcode in rapid succession.
• Invite "stuck on Creating…" when the email field was invalid.
• Password policy now persists when saved.
• Revoke invite no longer surfaces a fake "Failed to fetch" message.
• Session config loads correctly on Android by sending auth headers on the initial GET.