Add phase 3: comments and cooking mode

- Comments on visible recipes; author and admin may delete; per-user
  hourly rate limit (COMMENT_RATE_LIMIT_PER_HOUR)
- Cooking mode with large text, tick-off checklists, serving scaling and
  Screen Wake Lock to keep the display on
- Serving calculator auto-submits on change
- Privacy tests cover comment and cooking-mode URLs

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CLAUDE.md

@@ -7,7 +7,7 @@ port; TLS, domain and proxy are out of scope.
 ## Status
 - [x] Phase 1: Docker setup, DB, auth with invitations, roles
 - [x] Phase 2: Recipes CRUD, visibility (private/public), photos, notes, search, favourites
-- [ ] Phase 3: Comments, serving calculator, cooking mode (wake lock)
+- [x] Phase 3: Comments, serving calculator (server-side `?portionen=`), cooking mode (wake lock)
 - [ ] Phase 4: AI (OpenAI): clean up manual input + photo/screenshot import
 - [ ] Phase 5: Link import (schema.org JSON-LD, Instagram with paste fallback, Android PWA share target)
 - [ ] Phase 6: Backup script, full README
@@ -25,11 +25,13 @@ no JS build step: plain forms with small progressive enhancements in `static/js/
 - `accounts/` – custom `User` (e-mail login, `role` = user|admin), `Invitation`, `PasswordResetToken`,
   login/registration/reset views, admin area (`admin_views.py`, `/verwaltung/…`),
   `ensure_admin` management command (first admin from env).
-- `recipes/` – `Recipe` (+ `Ingredient`, `Step`, `Tag`, `RecipeImage`, `Favorite`). `RecipeQuerySet.visible_to/
+- `recipes/` – `Recipe` (+ `Ingredient`, `Step`, `Tag`, `RecipeImage`, `Favorite`, `Comment`). `RecipeQuerySet.visible_to/
   editable_by/deletable_by/search` hold all access rules. `parsing.py` converts the text form fields
   (one ingredient per line, `Gruppe:` headers, steps separated by blank lines) to structured data and
   scales amounts. `images.py` validates/re-encodes uploads (WebP 1600 px + 480 px thumb, no EXIF).
   Photos are served only via `recipes:photo` (`/bilder/<uuid>/<gross|klein>.webp`) after a visibility check.
+  Comments: deletable by their author and admins only (`CommentQuerySet.deletable_by`), rate-limited.
+  `tests/test_privacy.py` lists every recipe URL – add new recipe routes there.
 - `templates/`, `static/` – global templates, `app.css` (mobile first, dark mode), `app.js`.
 - `docker/entrypoint.sh` – migrate → ensure_admin → purge_ratelimits → gunicorn.
 - `scripts/` – `init-env.sh` (creates .env with secrets), `dev_server.py` (local run without Docker).