Plugin framework maturation, reports overhaul, theming, and USB frontend repair

Framework:
- Per-plugin Alembic migration chains (ADR-008): every bundled plugin
  carries its own chain with a stamp-only anchor at the ownership cutover;
  new plugin schema lands in plugins/<name>/migrations/, never the core
  chain. Deploys add flask plugin upgrade-all. Fixed a latent bug in the
  shared alembic template (engine URL resolution) and taught the metadata
  filter to include FK-referenced core tables.
- Frontend plugin route gating (ADR-009): plugin routes carry meta.plugin;
  a disabled plugin's pages redirect to the dashboard via a cached,
  fail-open check against the new public GET /api/plugins/enabled.
- get_reports() plugin hook (contract 0.5.0 -> 0.6.0): plugins contribute
  report cards; warranty and toner cards moved off the hardcoded list.

Reports:
- Hub grouped by category with search; inline reports render at the top,
  are URL-backed (?report=id, back-button and deep links work), expose
  their server-side filter params as controls, and export CSV. Warranty
  and Toner pages gained CSV export.
- Deleted the dead legacy Warranty Status report (always-zero buckets
  from a retired column).

Theming and fonts:
- Inter (variable) bundled locally via @fontsource, replacing the Google
  Fonts Roboto import - air-gapped installs now render correctly; tables
  use tabular numerals.
- Optional brand_primary_dark_color, brand_accent_color,
  brand_sidebar_color settings applied to CSS vars at bootstrap.

USB frontend repair (views were reading a dead legacy shape):
- List/detail/form and the employee profile USB panels remapped to the
  real API shape (device_id/device_desc/checkinoutlog); employee panels
  now use /usb/checkouts endpoints; external-mode /usb/checkouts/active
  honors the badge filter; dead client methods pruned.

Also: warranties list page no longer requires login (matches app
convention); collector doc rewritten with a GE-Enforce integration guide
and paste-ready PowerShell reporter; ADR index and CHANGELOG updated.

Verified: 323 tests pass, naming/style green, frontend builds, plugin
migration dry-run green on scratch MySQL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/views/employees/EmployeeDetail.vue

@@ -75,24 +75,20 @@
             <thead>
               <tr>
                 <th>Device</th>
-                <th>Serial Number</th>
                 <th>Checked Out</th>
-                <th>Purpose</th>
                 <th>Actions</th>
               </tr>
             </thead>
             <tbody>
-              <tr v-for="device in usbDevices" :key="device.usbdeviceid">
+              <tr v-for="checkout in usbDevices" :key="checkout.log_id">
                 <td>
-                  <router-link :to="`/usb/${device.usbdeviceid}`">
-                    {{ device.displayname }}
+                  <router-link :to="`/usb/${checkout.device_id}`">
+                    {{ checkout.device_id }}
                   </router-link>
                 </td>
-                <td>{{ device.serialnumber }}</td>
-                <td>{{ formatDate(device.checkoutdate) }}</td>
-                <td>{{ device.checkoutpurpose || '-' }}</td>
+                <td>{{ formatDate(checkout.timestamp) }}</td>
                 <td class="actions">
-                  <button class="btn btn-small btn-success" @click="checkinDevice(device)">
+                  <button class="btn btn-small btn-success" @click="checkinDevice(checkout)">
                     Check In
                   </button>
                 </td>
@@ -115,20 +111,18 @@
               <tr>
                 <th>Device</th>
                 <th>Checked Out</th>
-                <th>Checked In</th>
-                <th>Purpose</th>
+                <th>Device Status</th>
               </tr>
             </thead>
             <tbody>
-              <tr v-for="record in checkoutHistory" :key="record.usbcheckoutid">
+              <tr v-for="record in checkoutHistory" :key="record.log_id">
                 <td>
-                  <router-link :to="`/usb/${record.usbdeviceid}`">
-                    {{ record.devicename || `Device #${record.usbdeviceid}` }}
+                  <router-link :to="`/usb/${record.device_id}`">
+                    {{ record.device_id }}
                   </router-link>
                 </td>
-                <td>{{ formatDate(record.checkoutdate) }}</td>
-                <td>{{ record.checkindate ? formatDate(record.checkindate) : 'Still out' }}</td>
-                <td>{{ record.purpose || '-' }}</td>
+                <td>{{ formatDate(record.timestamp) }}</td>
+                <td>{{ record.device_status || '-' }}</td>
               </tr>
             </tbody>
           </table>
@@ -213,6 +207,7 @@ async function loadRecognitions() {
 async function loadUSBDevices() {
   usbLoading.value = true
   try {
+    // active check-out log rows for this badge
     const response = await usbApi.getUserCheckouts(route.params.sso)
     usbDevices.value = response.data.data || []
   } catch (err) {
@@ -225,10 +220,9 @@ async function loadUSBDevices() {
 async function loadCheckoutHistory() {
   historyLoading.value = true
   try {
-    // Get user's checkout history (all past checkouts)
-    const response = await usbApi.list({ user_id: route.params.sso, include_history: true })
-    // Filter to only show returned items (not currently checked out)
-    checkoutHistory.value = (response.data.data || []).filter(d => d.checkindate)
+    // all check-out log rows for this badge, newest first
+    const response = await usbApi.getUserCheckouts(route.params.sso, false)
+    checkoutHistory.value = response.data.data || []
   } catch (err) {
     console.error('Error loading checkout history:', err)
     checkoutHistory.value = []
@@ -237,11 +231,11 @@ async function loadCheckoutHistory() {
   }
 }
 
-async function checkinDevice(device) {
-  if (!confirm(`Check in ${device.displayname}?`)) return
+async function checkinDevice(checkout) {
+  if (!confirm(`Check in ${checkout.device_id}?`)) return
 
   try {
-    await usbApi.checkin(device.usbdeviceid)
+    await usbApi.checkin(checkout.device_id, { badge: checkout.badge_number || route.params.sso })
     await loadUSBDevices()
     await loadCheckoutHistory()
   } catch (err) {