Plugin framework maturation, reports overhaul, theming, and USB frontend repair

Framework:
- Per-plugin Alembic migration chains (ADR-008): every bundled plugin
  carries its own chain with a stamp-only anchor at the ownership cutover;
  new plugin schema lands in plugins/<name>/migrations/, never the core
  chain. Deploys add flask plugin upgrade-all. Fixed a latent bug in the
  shared alembic template (engine URL resolution) and taught the metadata
  filter to include FK-referenced core tables.
- Frontend plugin route gating (ADR-009): plugin routes carry meta.plugin;
  a disabled plugin's pages redirect to the dashboard via a cached,
  fail-open check against the new public GET /api/plugins/enabled.
- get_reports() plugin hook (contract 0.5.0 -> 0.6.0): plugins contribute
  report cards; warranty and toner cards moved off the hardcoded list.

Reports:
- Hub grouped by category with search; inline reports render at the top,
  are URL-backed (?report=id, back-button and deep links work), expose
  their server-side filter params as controls, and export CSV. Warranty
  and Toner pages gained CSV export.
- Deleted the dead legacy Warranty Status report (always-zero buckets
  from a retired column).

Theming and fonts:
- Inter (variable) bundled locally via @fontsource, replacing the Google
  Fonts Roboto import - air-gapped installs now render correctly; tables
  use tabular numerals.
- Optional brand_primary_dark_color, brand_accent_color,
  brand_sidebar_color settings applied to CSS vars at bootstrap.

USB frontend repair (views were reading a dead legacy shape):
- List/detail/form and the employee profile USB panels remapped to the
  real API shape (device_id/device_desc/checkinoutlog); employee panels
  now use /usb/checkouts endpoints; external-mode /usb/checkouts/active
  honors the badge filter; dead client methods pruned.

Also: warranties list page no longer requires login (matches app
convention); collector doc rewritten with a GE-Enforce integration guide
and paste-ready PowerShell reporter; ADR index and CHANGELOG updated.

Verified: 323 tests pass, naming/style green, frontend builds, plugin
migration dry-run green on scratch MySQL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/PLUGIN-HOOKS.md

@@ -9,7 +9,7 @@ The contract is locked in [ADR-001](../docs/adr/ADR-001-asset-as-platform-contra
 The framework declares its contract version in `shopdb/__init__.py`:
 
 ```python
-__contract_version__ = '0.4.0'
+__contract_version__ = '0.6.0'
 ```
 
 Each plugin's `manifest.json` declares the range of contract versions it supports:
@@ -192,6 +192,30 @@ class ComputersPlugin(BasePlugin):
 > already covers every bundled asset type; no plugin ever implemented the hook.
 > Search honors runtime plugin enable/disable.
 
+### `get_reports() -> List[Dict]`
+
+Returns report card definitions for the Reports hub. Added in contract 0.6.0.
+
+Each entry has `id`, `name`, `description`, `category`, plus EXACTLY ONE of
+`route` (a frontend path for a dedicated report page) or `endpoint` (an API
+endpoint the hub renders inline).
+
+```python
+class WarrantyPlugin(BasePlugin):
+    def get_reports(self):
+        return [{
+            'id': 'warranty',
+            'name': 'Warranty Report',
+            'description': 'Assets bucketed by coverage: expired, expiring soon, active',
+            'category': 'warranty',
+            'route': '/reports/warranty',
+        }]
+```
+
+Consumed by `GET /api/reports`, which merges plugin cards after the static core
+reports sorted into category groups by the frontend (disabled plugins are
+skipped; a broken plugin is isolated in prod, re-raised in dev/test).
+
 ### `get_collector_schema() -> Optional[Dict]`
 
 Declares the JSON Schema for an external collector pushing to `/api/collector/<pluginname>`. See [ADR-006](../docs/adr/ADR-006-collector-contract.md) for the contract.