Plugin framework maturation, reports overhaul, theming, and USB frontend repair

Framework:
- Per-plugin Alembic migration chains (ADR-008): every bundled plugin
  carries its own chain with a stamp-only anchor at the ownership cutover;
  new plugin schema lands in plugins/<name>/migrations/, never the core
  chain. Deploys add flask plugin upgrade-all. Fixed a latent bug in the
  shared alembic template (engine URL resolution) and taught the metadata
  filter to include FK-referenced core tables.
- Frontend plugin route gating (ADR-009): plugin routes carry meta.plugin;
  a disabled plugin's pages redirect to the dashboard via a cached,
  fail-open check against the new public GET /api/plugins/enabled.
- get_reports() plugin hook (contract 0.5.0 -> 0.6.0): plugins contribute
  report cards; warranty and toner cards moved off the hardcoded list.

Reports:
- Hub grouped by category with search; inline reports render at the top,
  are URL-backed (?report=id, back-button and deep links work), expose
  their server-side filter params as controls, and export CSV. Warranty
  and Toner pages gained CSV export.
- Deleted the dead legacy Warranty Status report (always-zero buckets
  from a retired column).

Theming and fonts:
- Inter (variable) bundled locally via @fontsource, replacing the Google
  Fonts Roboto import - air-gapped installs now render correctly; tables
  use tabular numerals.
- Optional brand_primary_dark_color, brand_accent_color,
  brand_sidebar_color settings applied to CSS vars at bootstrap.

USB frontend repair (views were reading a dead legacy shape):
- List/detail/form and the employee profile USB panels remapped to the
  real API shape (device_id/device_desc/checkinoutlog); employee panels
  now use /usb/checkouts endpoints; external-mode /usb/checkouts/active
  honors the badge filter; dead client methods pruned.

Also: warranties list page no longer requires login (matches app
convention); collector doc rewritten with a GE-Enforce integration guide
and paste-ready PowerShell reporter; ADR index and CHANGELOG updated.

Verified: 323 tests pass, naming/style green, frontend builds, plugin
migration dry-run green on scratch MySQL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shopdb/plugins/__init__.py

@@ -79,13 +79,14 @@ class PluginManager:
             self._register_plugin_components(plugin)
 
     def upgrade_all_plugins(self) -> Dict[str, str]:
-        """Run pending Alembic migrations for every loaded plugin.
+        """Run pending Alembic migrations for every discovered plugin.
 
         Returns {plugin_name: 'ok'|'no-migrations'|<error str>}. Skips
-        plugins with no migrations/ directory. Use from the CLI
-        (`flask plugin upgrade-all`) on a fresh deploy after the core
-        schema is in place; existing deploys that still use db.create_all
-        can ignore this and continue to do so.
+        plugins with no migrations/ directory. Driven by the CLI
+        (`flask plugin upgrade-all`), which every deploy runs after
+        `flask db upgrade`. Each bundled plugin's chain begins with a
+        stamp-only anchor (the core chain already built its tables); later
+        per-plugin migrations extend that chain. See ADR-008. Idempotent.
         """
         results: Dict[str, str] = {}
         if not self.migration_manager:
@@ -285,6 +286,18 @@ class PluginManager:
 
         self.registry.enable(name)
 
+        # Surface (do not auto-apply) a plugin chain that is ahead of the DB, so
+        # an operator enabling a plugin knows to run `flask plugin upgrade-all`.
+        try:
+            if self.migration_manager and \
+                    self.migration_manager.has_unapplied_migrations(name):
+                logger.warning(
+                    f"Plugin {name} has unapplied migrations; "
+                    f"run 'flask plugin upgrade-all'"
+                )
+        except Exception:
+            logger.debug(f"Could not check migration state for {name}")
+
         # Fire the on_enable hook best-effort. Do NOT register the blueprint
         # here: Flask forbids register_blueprint after the first request, so
         # routes/nav for a re-enabled plugin take effect on the next restart