Add lightweight Tauri shell, vendor offline libs, fix bugs and race conditions

- Add tauri/ subfolder: a Tauri-based desktop shell that loads the same
  index.html as the Electron app, producing a ~2MB installer (vs ~71MB for
  Electron) by using the OS WebView2 instead of bundled Chromium. Includes
  sync-frontend.js to keep tauri/dist/ in sync with the canonical index.html
  and vendor/ at build time (no UI duplication/drift).
- Vendor lucide, jsPDF, and jspdf-autotable locally under vendor/ instead of
  loading from CDNs, so the app works fully offline in both shells.
- Fix server.js path traversal vulnerability (sanitize/contain request paths).
- Fix exportPDF() using stale/edited piece data that could produce
  Infinity/NaN in generated PDFs; add a recalculate guard.
- Fix race conditions: overlapping copy/save-defaults button revert timers,
  and FileReader callbacks for logo/CSV import that could apply out of order.
- Minor cleanups: explicit array index parsing, hasResult() helper, consistent
  event binding for NMFC search results, cached DOM lookups.
- Document the dual-shell architecture and vendoring conventions in CLAUDE.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tauri/.gitignore

@@ -0,0 +1,7 @@
+node_modules/
+src-tauri/target/
+src-tauri/gen/schemas
+*.log
+
+# Generated by sync-frontend.js — copy of ../index.html and ../vendor/, not source of truth
+dist/

tauri/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "freight-calculator-pro-tauri",
+  "version": "1.2.0",
+  "description": "Professional Freight Class Calculator (Tauri shell)",
+  "private": true,
+  "scripts": {
+    "sync": "node sync-frontend.js",
+    "dev": "npm run sync && tauri dev",
+    "build": "npm run sync && tauri build",
+    "serve": "node ../server.js"
+  },
+  "license": "ISC",
+  "devDependencies": {
+    "@tauri-apps/cli": "^2.11.2"
+  }
+}

tauri/src-tauri/.gitignore

@@ -0,0 +1,4 @@
+# Generated by Cargo
+# will have compiled files and executables
+/target/
+/gen/schemas

tauri/src-tauri/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+name = "freight-calculator-pro"
+version = "1.2.0"
+description = "Professional Freight Class Calculator"
+authors = ["Devon Bontrager"]
+license = "ISC"
+repository = "https://gitea.netbird.zimspace.uk:5938/debont80/FreightCalculatorPro.git"
+edition = "2021"
+rust-version = "1.77.2"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[lib]
+name = "app_lib"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2.6.2", features = [] }
+
+[dependencies]
+serde_json = "1.0"
+serde = { version = "1.0", features = ["derive"] }
+log = "0.4"
+tauri = { version = "2.11.2", features = [] }
+tauri-plugin-log = "2"

tauri/src-tauri/build.rs

@@ -0,0 +1,3 @@
+fn main() {
+  tauri_build::build()
+}

tauri/src-tauri/capabilities/default.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "enables the default permissions",
+  "windows": [
+    "main"
+  ],
+  "permissions": [
+    "core:default"
+  ]
+}

tauri/src-tauri/src/lib.rs

@@ -0,0 +1,16 @@
+#[cfg_attr(mobile, tauri::mobile_entry_point)]
+pub fn run() {
+  tauri::Builder::default()
+    .setup(|app| {
+      if cfg!(debug_assertions) {
+        app.handle().plugin(
+          tauri_plugin_log::Builder::default()
+            .level(log::LevelFilter::Info)
+            .build(),
+        )?;
+      }
+      Ok(())
+    })
+    .run(tauri::generate_context!())
+    .expect("error while running tauri application");
+}

tauri/src-tauri/src/main.rs

@@ -0,0 +1,6 @@
+// Prevents additional console window on Windows in release, DO NOT REMOVE!!
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+fn main() {
+  app_lib::run();
+}

tauri/src-tauri/tauri.conf.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": "Freight Calculator Pro",
+  "version": "1.2.0",
+  "identifier": "com.freightcalc.pro",
+  "build": {
+    "frontendDist": "../dist"
+  },
+  "app": {
+    "windows": [
+      {
+        "title": "Freight Calculator Pro",
+        "width": 950,
+        "height": 950,
+        "minWidth": 800,
+        "minHeight": 700,
+        "resizable": true,
+        "fullscreen": false
+      }
+    ],
+    "security": {
+      "csp": null
+    }
+  },
+  "bundle": {
+    "active": true,
+    "targets": "all",
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.icns",
+      "icons/icon.ico"
+    ]
+  }
+}

tauri/sync-frontend.js

@@ -0,0 +1,27 @@
+// Copies the canonical frontend (../index.html and ../vendor/) into ./dist
+// before each Tauri dev/build run, so the Tauri shell always packages the
+// exact same UI as the Electron version — no manual sync, no drift.
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.join(__dirname, '..');
+const DIST = path.join(__dirname, 'dist');
+
+function copyRecursive(src, dest) {
+    const stat = fs.statSync(src);
+    if (stat.isDirectory()) {
+        fs.mkdirSync(dest, { recursive: true });
+        for (const entry of fs.readdirSync(src)) {
+            copyRecursive(path.join(src, entry), path.join(dest, entry));
+        }
+    } else {
+        fs.copyFileSync(src, dest);
+    }
+}
+
+fs.rmSync(DIST, { recursive: true, force: true });
+fs.mkdirSync(DIST, { recursive: true });
+copyRecursive(path.join(ROOT, 'index.html'), path.join(DIST, 'index.html'));
+copyRecursive(path.join(ROOT, 'vendor'), path.join(DIST, 'vendor'));
+
+console.log(`Synced frontend (index.html + vendor/) from ${ROOT} -> ${DIST}`);