Plugin framework maturation, reports overhaul, theming, and USB frontend repair

Framework:
- Per-plugin Alembic migration chains (ADR-008): every bundled plugin
  carries its own chain with a stamp-only anchor at the ownership cutover;
  new plugin schema lands in plugins/<name>/migrations/, never the core
  chain. Deploys add flask plugin upgrade-all. Fixed a latent bug in the
  shared alembic template (engine URL resolution) and taught the metadata
  filter to include FK-referenced core tables.
- Frontend plugin route gating (ADR-009): plugin routes carry meta.plugin;
  a disabled plugin's pages redirect to the dashboard via a cached,
  fail-open check against the new public GET /api/plugins/enabled.
- get_reports() plugin hook (contract 0.5.0 -> 0.6.0): plugins contribute
  report cards; warranty and toner cards moved off the hardcoded list.

Reports:
- Hub grouped by category with search; inline reports render at the top,
  are URL-backed (?report=id, back-button and deep links work), expose
  their server-side filter params as controls, and export CSV. Warranty
  and Toner pages gained CSV export.
- Deleted the dead legacy Warranty Status report (always-zero buckets
  from a retired column).

Theming and fonts:
- Inter (variable) bundled locally via @fontsource, replacing the Google
  Fonts Roboto import - air-gapped installs now render correctly; tables
  use tabular numerals.
- Optional brand_primary_dark_color, brand_accent_color,
  brand_sidebar_color settings applied to CSS vars at bootstrap.

USB frontend repair (views were reading a dead legacy shape):
- List/detail/form and the employee profile USB panels remapped to the
  real API shape (device_id/device_desc/checkinoutlog); employee panels
  now use /usb/checkouts endpoints; external-mode /usb/checkouts/active
  honors the badge filter; dead client methods pruned.

Also: warranties list page no longer requires login (matches app
convention); collector doc rewritten with a GE-Enforce integration guide
and paste-ready PowerShell reporter; ADR index and CHANGELOG updated.

Verified: 323 tests pass, naming/style green, frontend builds, plugin
migration dry-run green on scratch MySQL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shopdb/plugins/cli.py

@@ -110,6 +110,15 @@ def enable_plugin(name: str):
 
     if pm.enable_plugin(name):
         click.echo(click.style(f"Enabled {name}", fg='green'))
+        # Nudge the operator if the plugin's chain is ahead of the DB.
+        try:
+            if pm.migration_manager and \
+                    pm.migration_manager.has_unapplied_migrations(name):
+                click.echo(click.style(
+                    f"  {name} has unapplied migrations - "
+                    f"run 'flask plugin upgrade-all'", fg='yellow'))
+        except Exception:
+            pass
     else:
         click.echo(click.style(f"Failed to enable {name}", fg='red'))
         raise SystemExit(1)
@@ -213,9 +222,11 @@ def new_plugin(name: str, description: str, overwrite: bool):
     click.echo('Next steps:')
     click.echo(f'  1. Edit plugins/{name}/models/{name}.py with your domain fields')
     click.echo(f'  2. Edit plugins/{name}/api/routes.py with your endpoints')
-    click.echo(f'  3. Run: flask plugin install {name}')
-    click.echo(f'  4. Run: flask db migrate -m "Add {name} plugin"')
-    click.echo(f'  5. Run: flask db upgrade')
+    click.echo(f'  3. Add plugins/{name}/migrations/ with an Alembic chain that')
+    click.echo(f'     creates your tables (per-plugin chain, NOT the core chain;')
+    click.echo(f'     see ADR-008). Register the tables in PLUGIN_TABLE_OWNERS.')
+    click.echo(f'  4. Run: flask plugin install {name}')
+    click.echo(f'  5. Run: flask plugin upgrade-all')
     click.echo(f'  6. Run: pytest plugins/{name}/tests/')
 
 
@@ -246,12 +257,12 @@ def migrate_plugin(name: str, revision: str):
 @plugin_cli.command('upgrade-all')
 @with_appcontext
 def upgrade_all_plugins():
-    """Run pending migrations for every loaded plugin.
+    """Run pending migrations for every discovered plugin.
 
-    Idempotent. Use on a fresh deploy after core schema is in place,
-    instead of (or alongside) `db-utils create-all`. Existing deployments
-    that still bootstrap plugin tables via db.create_all can ignore this
-    command until ready to move a plugin onto its Alembic version chain.
+    Idempotent. Run this after `flask db upgrade` on every deploy and
+    upgrade. It stamps each bundled plugin's anchor revision into
+    alembic_version_<plugin> and applies any per-plugin migrations added
+    after the ownership cutover (ADR-008). Safe to re-run at head.
     """
     pm = current_app.extensions.get('plugin_manager')
     if not pm: