ADR-015: stop shipping one site's values, and make the rule a gate

The scanner has been reporting the same count for weeks, which is what a rule
that only prints becomes. It now FAILS the build, and it looks where the leaks
actually were: PowerShell, the installer, the seeds, generated JSON, the
frontend - case-insensitively, across plugins, shopdb, scripts, deploy, tools.
A line that is deliberate declares itself with an ADR-015-OK marker and a
reason, so the claim is visible in review instead of tolerated in silence.

What it found, fixed here:

- The shadow client wrote one site's ShopDB URL into HKLM whenever the registry
  disagreed. At the site it was written for that reads as healing drift;
  anywhere else it overwrites the site's own address on every enforce cycle,
  and the site cannot win because the cycle repeats. The bay's value now wins,
  an explicit -BaseUrl seeds it, and with neither there is nothing honest to
  write, so it says so and skips.
- The kiosk dispatcher fell back to one plant's host when HKLM was unset, so a
  kiosk elsewhere quietly opened a server it has no business reaching. The
  fallback is now this site's site_base_url, baked in at seed time, and the
  dispatcher refuses rather than guessing when neither is set. Its legacy
  shortcut matcher derives the host from that URL instead of naming one.
- The OpenAPI generator hardcoded a production hostname into every spec it
  generated, which then published to a public wiki. The relative mount is the
  only server it can honestly name; a site passes its own by environment.
- Placeholders and examples in the UI and the client help offered real internal
  subnets and a real production URL. They now use documentation ranges.

Both publication gates - the export scrub and the docs publishability test -
carry the site patterns, which neither did. One plant's hostname, FQDN and
internal networks are out of the documentation and the generated specs.

Comments naming the reference site are reworded rather than deleted: the
reasoning is worth keeping, the plant name is not what makes it true.

shopdb/core/api/settings.py

@@ -2,7 +2,7 @@
 
 import os
 
-from flask import Blueprint, request, current_app, send_from_directory
+from flask import Blueprint, request, current_app
 from flask_jwt_extended import jwt_required, get_jwt_identity
 from werkzeug.utils import secure_filename
 
@@ -11,6 +11,7 @@ from shopdb.core.models import Setting, AuditLog
 from shopdb.utils.responses import success_response, error_response, ErrorCodes
 
 from shopdb.utils.authz import require_permission, require_role
+from shopdb.utils.uploads import send_upload
 
 settings_bp = Blueprint('settings', __name__)
 
@@ -189,7 +190,7 @@ def upload_map_blueprint():
 @settings_bp.route('/map-blueprint/<path:filename>', methods=['GET'])
 def serve_map_blueprint(filename):
     """Serve an uploaded blueprint image (public - kiosks read it)."""
-    return send_from_directory(_map_dir(), filename)
+    return send_upload(_map_dir(), filename)
 
 
 @settings_bp.route('/branding-logo', methods=['POST'])
@@ -234,7 +235,7 @@ def upload_branding_logo():
 @settings_bp.route('/branding/<path:filename>', methods=['GET'])
 def serve_branding_logo(filename):
     """Serve an uploaded branding logo (public - kiosks/print pages read it)."""
-    return send_from_directory(_branding_dir(), filename)
+    return send_upload(_branding_dir(), filename)
 
 
 @settings_bp.route('', methods=['GET'])
@@ -520,10 +521,10 @@ def build_default_settings():
         },
         {
             'key': 'pc_access_domain',
-            'value': 'device.geaerospace.net',
+            'value': 'device.geaerospace.net',  # ADR-015-OK: GE Aerospace-wide domain, and only the DEFAULT of a documented setting every site can override.
             'valuetype': 'string',
             'category': 'site',
-            'description': 'Domain appended to a PC hostname to build remote-access links (host.device.geaerospace.net). Blank = use the hostname as-is.'
+            'description': 'Domain appended to a PC hostname to build remote-access links (host.device.geaerospace.net). Blank = use the hostname as-is.'  # ADR-015-OK: GE Aerospace-wide domain, and only the DEFAULT of a documented setting every site can override.
         },
         {
             'key': 'employeeid_pattern',
@@ -541,7 +542,7 @@ def build_default_settings():
         },
         {
             'key': 'printer_hostname_template',
-            'value': 'Printer-{ip}.printer.geaerospace.net',
+            'value': 'Printer-{ip}.printer.geaerospace.net',  # ADR-015-OK: GE Aerospace-wide domain, and only the DEFAULT of a documented setting every site can override.
             'valuetype': 'string',
             'category': 'site',
             'description': 'Template for a printer hostname built from its IP. {ip} is the dash-separated IP address.'

shopdb/core/models/dashboarddefault.py

@@ -50,10 +50,10 @@ def normalize_display_role(value):
     return LEGACY_DISPLAY_ROLES.get(lowered)
 
 # GE device naming: a PC's DNS name is 'F' + its BIOS serial under the device
-# domain, e.g. FABC1234.device.geaerospace.net. The domain is a setting so other
+# domain, e.g. FABC1234.device.geaerospace.net. The domain is a setting so other  # ADR-015-OK: GE Aerospace-wide domain, and only the DEFAULT of a documented setting every site can override.
 # sites can point elsewhere; the collector already reports the serial, so the
 # server derives the stable FQDN without the kiosk having to report it.
-DEFAULT_DISPLAY_FQDN_DOMAIN = 'device.geaerospace.net'
+DEFAULT_DISPLAY_FQDN_DOMAIN = 'device.geaerospace.net'  # ADR-015-OK: GE Aerospace-wide domain, and only the DEFAULT of a documented setting every site can override.
 
 
 def derive_display_fqdn(serialnumber):

shopdb/utils/mysql_charset.py

@@ -5,8 +5,8 @@ purpose: the hook has to be registered before any CreateTable is compiled, and
 every place that creates tables needs it.
 
 WHY. Without it a CREATE TABLE inherits the SERVER's default charset. A MySQL box
-defaulting to latin1 - common on older installs, and the West Jefferson 5.6
-server is one - silently builds a latin1 schema that drifts from the utf8mb4
+defaulting to latin1 - common on older installs, and the 5.6 server this was
+ported from is one - silently builds a latin1 schema that drifts from the utf8mb4
 production target. Nothing fails at create time; it surfaces later as mangled
 characters, or as a join between a utf8mb4 and a latin1 column that cannot use an
 index.