Employees + USB default-disabled with an enable-time provisioning note

Both plugins provision extra tables, so they now install disabled and explain
themselves before a site opts in.

- Plugin contract gains get_provisioning_note() -> {tables, note, docs}.
  Employees and USB implement it (what tables get created in shopdb, how they
  are referenced, link to the schema README; USB references the captured
  DLP/reminder plans).
- Manifest default_enabled=false for employees + usb; the plugins list API
  returns provisioning_note + default_enabled; install now registers a plugin
  disabled when default_enabled is false.
- Setup wizard Features step renders the provisioning note the moment a plugin
  with one is enabled.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/employees/manifest.json

@@ -7,6 +7,9 @@
   "core_version": ">=0.1.0,<1.0.0",
   "api_prefix": "/api/employees",
   "provides": {
-    "features": ["employee_directory"]
-  }
-}
+    "features": [
+      "employee_directory"
+    ]
+  },
+  "default_enabled": false
+}

plugins/employees/plugin.py

@@ -60,6 +60,20 @@ class EmployeesPlugin(BasePlugin):
         External mode reads a separate DB via employee_connection instead."""
         return [DirectoryEmployee]
 
+    def get_provisioning_note(self) -> Optional[Dict]:
+        return {
+            'tables': ['directoryemployees'],
+            'note': ('Enabling this in self-hosted mode creates a '
+                     '"directoryemployees" table in the shopdb database (SSO, '
+                     'First_Name, Last_Name, Team, Role, Picture). It is '
+                     'referenced across the site: employee search, notification '
+                     'recognition (name + photo on the shopfloor/lobby displays), '
+                     'and USB check-in/out name resolution. Manage people under '
+                     'Settings > Employee Directory, or point at an existing HR '
+                     'database instead (external mode).'),
+            'docs': 'plugins/employees/README.md',
+        }
+
     def get_config_schema(self) -> List[Dict]:
         """Employee directory DB connection. Host/name/user are settings the
         wizard can edit; the password stays in .env (emitted, not stored)."""

plugins/usb/manifest.json

@@ -1,9 +1,10 @@
 {
-    "name": "usb",
-    "version": "1.0.0",
-    "description": "USB device checkout management",
-    "author": "ShopDB Team",
-    "dependencies": [],
-    "core_version": ">=0.1.0,<1.0.0",
-    "api_prefix": "/api/usb"
-}
+  "name": "usb",
+  "version": "1.0.0",
+  "description": "USB device checkout management",
+  "author": "ShopDB Team",
+  "dependencies": [],
+  "core_version": ">=0.1.0,<1.0.0",
+  "api_prefix": "/api/usb",
+  "default_enabled": false
+}

plugins/usb/plugin.py

@@ -56,6 +56,20 @@ class USBPlugin(BasePlugin):
         """Return list of SQLAlchemy model classes."""
         return [USBDeviceType, USBDevice, USBCheckout]
 
+    def get_provisioning_note(self) -> Optional[Dict]:
+        return {
+            'tables': ['usbdevicetypes', 'usbdevices', 'usbcheckouts'],
+            'note': ('Enabling this creates USB tracking tables in the shopdb '
+                     'database (usbdevicetypes, usbdevices, usbcheckouts) for CMMC '
+                     'removable-media check-in/out. Devices, check-in/out events, '
+                     'and per-event log ids live here. Planned build-out: a USB-ID '
+                     'standard, overdue-device email reminders, and DLP/Fabric '
+                     'approval integration (see the captured design notes). A site '
+                     'with an existing cmmc_usb database can use external mode '
+                     'instead.'),
+            'docs': 'plugins/usb/README.md',
+        }
+
     def get_config_schema(self) -> List[Dict]:
         """CMMC USB check-in/out database connection. Host/name/user are settings
         the wizard can edit; the password stays in .env (emitted, not stored)."""