Plugin framework maturation, reports overhaul, theming, and USB frontend repair

Framework:
- Per-plugin Alembic migration chains (ADR-008): every bundled plugin
  carries its own chain with a stamp-only anchor at the ownership cutover;
  new plugin schema lands in plugins/<name>/migrations/, never the core
  chain. Deploys add flask plugin upgrade-all. Fixed a latent bug in the
  shared alembic template (engine URL resolution) and taught the metadata
  filter to include FK-referenced core tables.
- Frontend plugin route gating (ADR-009): plugin routes carry meta.plugin;
  a disabled plugin's pages redirect to the dashboard via a cached,
  fail-open check against the new public GET /api/plugins/enabled.
- get_reports() plugin hook (contract 0.5.0 -> 0.6.0): plugins contribute
  report cards; warranty and toner cards moved off the hardcoded list.

Reports:
- Hub grouped by category with search; inline reports render at the top,
  are URL-backed (?report=id, back-button and deep links work), expose
  their server-side filter params as controls, and export CSV. Warranty
  and Toner pages gained CSV export.
- Deleted the dead legacy Warranty Status report (always-zero buckets
  from a retired column).

Theming and fonts:
- Inter (variable) bundled locally via @fontsource, replacing the Google
  Fonts Roboto import - air-gapped installs now render correctly; tables
  use tabular numerals.
- Optional brand_primary_dark_color, brand_accent_color,
  brand_sidebar_color settings applied to CSS vars at bootstrap.

USB frontend repair (views were reading a dead legacy shape):
- List/detail/form and the employee profile USB panels remapped to the
  real API shape (device_id/device_desc/checkinoutlog); employee panels
  now use /usb/checkouts endpoints; external-mode /usb/checkouts/active
  honors the badge filter; dead client methods pruned.

Also: warranties list page no longer requires login (matches app
convention); collector doc rewritten with a GE-Enforce integration guide
and paste-ready PowerShell reporter; ADR index and CHANGELOG updated.

Verified: 323 tests pass, naming/style green, frontend builds, plugin
migration dry-run green on scratch MySQL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plugins/usb/api/routes.py

@@ -683,9 +683,19 @@ def list_all_checkouts():
 @usb_bp.route('/checkouts/active', methods=['GET'])
 @jwt_required(optional=True)
 def list_active_checkouts():
-    """List the latest check-out log row for every currently checked-out device."""
+    """List the latest check-out log row for every currently checked-out device.
+
+    Query parameters:
+    - badge: filter by badge_number
+    """
     if _usb_selfhosted():
         return selfhosted.list_checkouts(request, active_only=True)
+    where_badge = ''
+    params = []
+    badge = request.args.get('badge', '').strip()
+    if badge:
+        where_badge = 'AND l.badge_number = %s '
+        params.append(badge)
     conn = cmmc_usb_connection()
     try:
         with conn.cursor() as cur:
@@ -697,11 +707,13 @@ def list_active_checkouts():
                 'JOIN checkinoutlog l ON l.device_id = d.device_id '
                 "AND l.action = 'check-out' "
                 "WHERE d.status = 'checked-out' "
+                + where_badge +
                 'AND l.log_id = ('
                 '  SELECT MAX(l2.log_id) FROM checkinoutlog l2 '
                 "  WHERE l2.device_id = d.device_id AND l2.action = 'check-out'"
                 ') '
                 'ORDER BY l.timestamp DESC, l.log_id DESC',
+                params,
             )
             rows = cur.fetchall()
             data = [_log_to_dict(cur, row) for row in rows]