Plugin framework maturation, reports overhaul, theming, and USB frontend repair

Framework:
- Per-plugin Alembic migration chains (ADR-008): every bundled plugin
  carries its own chain with a stamp-only anchor at the ownership cutover;
  new plugin schema lands in plugins/<name>/migrations/, never the core
  chain. Deploys add flask plugin upgrade-all. Fixed a latent bug in the
  shared alembic template (engine URL resolution) and taught the metadata
  filter to include FK-referenced core tables.
- Frontend plugin route gating (ADR-009): plugin routes carry meta.plugin;
  a disabled plugin's pages redirect to the dashboard via a cached,
  fail-open check against the new public GET /api/plugins/enabled.
- get_reports() plugin hook (contract 0.5.0 -> 0.6.0): plugins contribute
  report cards; warranty and toner cards moved off the hardcoded list.

Reports:
- Hub grouped by category with search; inline reports render at the top,
  are URL-backed (?report=id, back-button and deep links work), expose
  their server-side filter params as controls, and export CSV. Warranty
  and Toner pages gained CSV export.
- Deleted the dead legacy Warranty Status report (always-zero buckets
  from a retired column).

Theming and fonts:
- Inter (variable) bundled locally via @fontsource, replacing the Google
  Fonts Roboto import - air-gapped installs now render correctly; tables
  use tabular numerals.
- Optional brand_primary_dark_color, brand_accent_color,
  brand_sidebar_color settings applied to CSS vars at bootstrap.

USB frontend repair (views were reading a dead legacy shape):
- List/detail/form and the employee profile USB panels remapped to the
  real API shape (device_id/device_desc/checkinoutlog); employee panels
  now use /usb/checkouts endpoints; external-mode /usb/checkouts/active
  honors the badge filter; dead client methods pruned.

Also: warranties list page no longer requires login (matches app
convention); collector doc rewritten with a GE-Enforce integration guide
and paste-ready PowerShell reporter; ADR index and CHANGELOG updated.

Verified: 323 tests pass, naming/style green, frontend builds, plugin
migration dry-run green on scratch MySQL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/router/index.js

@@ -3,6 +3,8 @@ import { useAuthStore } from '../stores/auth'
 import AppLayout from '../views/AppLayout.vue'
 import SettingsLayout from '../views/settings/SettingsLayout.vue'
 import { setupComplete, setupSkipped, isSetupLoaded, refreshSetupState } from '../composables/setupState'
+import { loadEnabledPlugins, isPluginEnabled } from '../composables/enabledPlugins'
+import { useToast } from '../composables/toast'
 
 // Auto-discover all route modules from routes/ directory
 const routeModules = import.meta.glob('./routes/*.js', { eager: true })
@@ -59,7 +61,8 @@ const routes = [
   {
     path: '/tv',
     name: 'tv',
-    component: () => import('../views/TVDashboard.vue')
+    component: () => import('../views/TVDashboard.vue'),
+    meta: { plugin: 'slides' }
   },
   // Print pages (standalone, no sidebar/header)
   {
@@ -70,17 +73,20 @@ const routes = [
   {
     path: '/print/printer-qr',
     name: 'print-printer-qr-batch',
-    component: () => import('../views/print/PrinterQRBatch.vue')
+    component: () => import('../views/print/PrinterQRBatch.vue'),
+    meta: { plugin: 'printers' }
   },
   {
     path: '/print/printer-qr/:id',
     name: 'print-printer-qr-single',
-    component: () => import('../views/print/PrinterQRSingle.vue')
+    component: () => import('../views/print/PrinterQRSingle.vue'),
+    meta: { plugin: 'printers' }
   },
   {
     path: '/print/usb-labels',
     name: 'print-usb-labels',
-    component: () => import('../views/print/USBLabelBatch.vue')
+    component: () => import('../views/print/USBLabelBatch.vue'),
+    meta: { plugin: 'usb' }
   },
   {
     path: '/',
@@ -108,6 +114,17 @@ router.beforeEach(async (to, from, next) => {
     return next('/')
   }
 
+  // Plugin gating: a disabled backend plugin's frontend routes are dead ends.
+  // The enabled list is fetched once and cached; fail-open on error so a blip
+  // cannot brick navigation. Works unauthenticated (endpoint is jwt-optional).
+  if (to.meta.plugin) {
+    await loadEnabledPlugins()
+    if (!isPluginEnabled(to.meta.plugin)) {
+      useToast().info(`The ${to.meta.plugin} feature is not enabled.`)
+      return next('/')
+    }
+  }
+
   // First-run: steer a fresh admin into the setup wizard (once, until finished).
   if (authStore.isAuthenticated && authStore.isAdmin && to.path !== '/setup') {
     if (!isSetupLoaded()) {