Plugin framework maturation, reports overhaul, theming, and USB frontend repair

Framework:
- Per-plugin Alembic migration chains (ADR-008): every bundled plugin
  carries its own chain with a stamp-only anchor at the ownership cutover;
  new plugin schema lands in plugins/<name>/migrations/, never the core
  chain. Deploys add flask plugin upgrade-all. Fixed a latent bug in the
  shared alembic template (engine URL resolution) and taught the metadata
  filter to include FK-referenced core tables.
- Frontend plugin route gating (ADR-009): plugin routes carry meta.plugin;
  a disabled plugin's pages redirect to the dashboard via a cached,
  fail-open check against the new public GET /api/plugins/enabled.
- get_reports() plugin hook (contract 0.5.0 -> 0.6.0): plugins contribute
  report cards; warranty and toner cards moved off the hardcoded list.

Reports:
- Hub grouped by category with search; inline reports render at the top,
  are URL-backed (?report=id, back-button and deep links work), expose
  their server-side filter params as controls, and export CSV. Warranty
  and Toner pages gained CSV export.
- Deleted the dead legacy Warranty Status report (always-zero buckets
  from a retired column).

Theming and fonts:
- Inter (variable) bundled locally via @fontsource, replacing the Google
  Fonts Roboto import - air-gapped installs now render correctly; tables
  use tabular numerals.
- Optional brand_primary_dark_color, brand_accent_color,
  brand_sidebar_color settings applied to CSS vars at bootstrap.

USB frontend repair (views were reading a dead legacy shape):
- List/detail/form and the employee profile USB panels remapped to the
  real API shape (device_id/device_desc/checkinoutlog); employee panels
  now use /usb/checkouts endpoints; external-mode /usb/checkouts/active
  honors the badge filter; dead client methods pruned.

Also: warranties list page no longer requires login (matches app
convention); collector doc rewritten with a GE-Enforce integration guide
and paste-ready PowerShell reporter; ADR index and CHANGELOG updated.

Verified: 323 tests pass, naming/style green, frontend builds, plugin
migration dry-run green on scratch MySQL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/composables/enabledPlugins.js

@@ -0,0 +1,42 @@
+// Enabled-plugin gating for the router. Fetches the enabled plugin-name list
+// ONCE (cached promise) so a disabled backend plugin's frontend routes become
+// unreachable by direct URL. Fail-open: any fetch error treats every plugin as
+// enabled, so an API blip can never brick navigation.
+import { pluginsApi } from '../api'
+
+let enabledPromise = null
+let enabledSet = null // resolved Set<string>, or null while pending / on failure
+
+// Kick off (or reuse) the single fetch. The endpoint is jwt-optional so this
+// works on unauthenticated kiosk routes (e.g. /tv) too.
+export function loadEnabledPlugins() {
+  if (!enabledPromise) {
+    enabledPromise = pluginsApi.enabled()
+      .then(response => {
+        const names = response?.data?.data
+        // Only trust a real array; anything else -> fail open (null).
+        enabledSet = Array.isArray(names) ? new Set(names) : null
+        return enabledSet
+      })
+      .catch(() => {
+        // Fail open: leave enabledSet null so isPluginEnabled returns true.
+        enabledSet = null
+        return null
+      })
+  }
+  return enabledPromise
+}
+
+// True if the plugin is enabled OR the list is unknown (fail-open). A null
+// enabledSet means we never got a trustworthy answer, so allow everything.
+export function isPluginEnabled(name) {
+  if (!name) return true
+  if (enabledSet === null) return true
+  return enabledSet.has(name)
+}
+
+// Test/hot-reload hook: forget the cached result so the next call refetches.
+export function resetEnabledPlugins() {
+  enabledPromise = null
+  enabledSet = null
+}