Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`

A recipe management app fails to validate user input on a shopping list endpoint, allowing attackers to crash the server with invalid data or associate shopping items with units from other users' spaces, potentially exposing private information.

The POST /api/food/{id}/shopping/ endpoint bypasses the ShoppingListEntrySerializer validation by directly reading amount and unit from request.data without sanitization, enabling injection of non-numeric amounts (CWE-1284) and cross-tenant unit association (CWE-639). This occurs because other endpoints properly validate via the serializer, but this one does not, allowing an authenticated attacker to trigger HTTP 500 errors or leak foreign-key references across Space boundaries.