docs: update README and PROJECT.md with OCR, barcode, auto-checkin changes

PROJECT.md

@@ -27,10 +27,10 @@ canteen-asset-tracker/
 ```
 
 - **Port:** 8901 (HTTPS)
-- **URL:** https://canteen.ourpad.casa:8901
-- **Frontend:** Single HTML file — no build step, no npm. All JS/CSS/HTML in one file.
-- **Backend:** FastAPI with SQLite (WAL mode). 48 named routes + 30 dynamic settings routes.
-- **Tests:** 319 backend tests passing. No frontend tests yet.
+- **URL:** https://canteen.ourpad.casa (NPMPlus reverse proxy → backend :8901)
+- **Frontend:** Single HTML file — no build step, no npm. All JS/CSS/HTML in one file (~284KB).
+- **Backend:** FastAPI with SQLite (WAL mode). Auth via Bearer tokens. OCR via Tesseract.
+- **Tests:** pytest test suite + Playwright E2E browser tests.
 
 ## Android App (`canteen-asset-tracker-android`)
 
@@ -128,3 +128,11 @@ cd ~/projects/canteen-asset-tracker-android
 ./gradlew assembleRelease           # build APK
 ./gradlew test                      # run unit tests
 ```
+
+## Recent Changes (May 2026)
+
+- **OCR fix** — Now extracts only the last 5 digits from Connect ID (e.g., `05912-095330` → `95330`). Added `raw_match` field to response for debugging.
+- **Barcode scanner fix** — Switched from `decodeFromVideoElement` to `decodeFromVideoDevice` with 1D-only format hints (Code 128, Code 39, EAN/UPC, ITF, Codabar). Added `TRY_HARDER` hint and 50ms scan interval for fast, reliable detection.
+- **Auto check-in** — New assets automatically check in with GPS on creation (all three entry modes: barcode, OCR, manual). Best-effort: silently skips if GPS unavailable.
+- **Service stability** — Added NPMPlus reverse proxy. Service runs as background process on port 8901.
+- **Admin password** — Updated to `Brett85!@`.