Plugin framework maturation, reports overhaul, theming, and USB frontend repair

Framework:
- Per-plugin Alembic migration chains (ADR-008): every bundled plugin
  carries its own chain with a stamp-only anchor at the ownership cutover;
  new plugin schema lands in plugins/<name>/migrations/, never the core
  chain. Deploys add flask plugin upgrade-all. Fixed a latent bug in the
  shared alembic template (engine URL resolution) and taught the metadata
  filter to include FK-referenced core tables.
- Frontend plugin route gating (ADR-009): plugin routes carry meta.plugin;
  a disabled plugin's pages redirect to the dashboard via a cached,
  fail-open check against the new public GET /api/plugins/enabled.
- get_reports() plugin hook (contract 0.5.0 -> 0.6.0): plugins contribute
  report cards; warranty and toner cards moved off the hardcoded list.

Reports:
- Hub grouped by category with search; inline reports render at the top,
  are URL-backed (?report=id, back-button and deep links work), expose
  their server-side filter params as controls, and export CSV. Warranty
  and Toner pages gained CSV export.
- Deleted the dead legacy Warranty Status report (always-zero buckets
  from a retired column).

Theming and fonts:
- Inter (variable) bundled locally via @fontsource, replacing the Google
  Fonts Roboto import - air-gapped installs now render correctly; tables
  use tabular numerals.
- Optional brand_primary_dark_color, brand_accent_color,
  brand_sidebar_color settings applied to CSS vars at bootstrap.

USB frontend repair (views were reading a dead legacy shape):
- List/detail/form and the employee profile USB panels remapped to the
  real API shape (device_id/device_desc/checkinoutlog); employee panels
  now use /usb/checkouts endpoints; external-mode /usb/checkouts/active
  honors the badge filter; dead client methods pruned.

Also: warranties list page no longer requires login (matches app
convention); collector doc rewritten with a GE-Enforce integration guide
and paste-ready PowerShell reporter; ADR index and CHANGELOG updated.

Verified: 323 tests pass, naming/style green, frontend builds, plugin
migration dry-run green on scratch MySQL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_core/test_plugins_enabled.py

@@ -0,0 +1,29 @@
+"""GET /api/plugins/enabled: the flat enabled-plugin-name list that drives
+frontend route gating (ADR-009).
+
+Pins two properties: the endpoint is reachable anonymously and returns a
+plain array of names, and a disabled plugin's name drops out of that array
+(so its frontend routes gate off), mirroring the search-disabled pattern.
+"""
+
+
+def test_enabled_anonymous_returns_array(client):
+    """No auth required (jwt-optional): returns a flat array of name strings."""
+    resp = client.get('/api/plugins/enabled')
+    assert resp.status_code == 200, resp.get_json()
+    data = resp.get_json()['data']
+    assert isinstance(data, list)
+    assert all(isinstance(name, str) for name in data)
+
+
+def test_disabled_plugin_absent(app, client, monkeypatch):
+    """A disabled plugin's name is missing; enabled ones remain present."""
+    pm = app.extensions['plugin_manager']
+    # Pretend printers is enabled but usb is not.
+    monkeypatch.setattr(pm.registry, 'get_enabled_plugins',
+                        lambda: ['printers', 'computers'])
+    resp = client.get('/api/plugins/enabled')
+    assert resp.status_code == 200, resp.get_json()
+    data = resp.get_json()['data']
+    assert 'printers' in data
+    assert 'usb' not in data

tests/test_core/test_reports_hook.py

@@ -0,0 +1,55 @@
+"""Tests for the get_reports hook consumer (GET /api/reports).
+
+Pins the wiring added for BasePlugin.get_reports: the reports list merges
+enabled plugins' report cards after the static core reports and skips disabled
+ones. Also guards the removed legacy warranty-status core report.
+
+Plugin enabled-state is monkeypatched (not persisted) so these tests do not
+mutate the shared instance/plugins.json registry file.
+"""
+
+
+def _report_ids(client, headers):
+    response = client.get('/api/reports', headers=headers)
+    assert response.status_code == 200, response.get_json()
+    reports = response.get_json()['data']['reports']
+    assert isinstance(reports, list)
+    return reports, {r['id'] for r in reports}
+
+
+def test_reports_include_core_reports(client, auth_headers):
+    """The static core reports are always listed."""
+    _, ids = _report_ids(client, auth_headers)
+    assert 'equipment-by-type' in ids
+    assert 'pc-relationships' in ids
+
+
+def test_legacy_warranty_status_report_absent(client, auth_headers):
+    """The dead warranty-status core report was removed."""
+    _, ids = _report_ids(client, auth_headers)
+    assert 'warranty-status' not in ids
+
+
+def test_enabled_plugin_reports_are_merged(app, client, auth_headers, monkeypatch):
+    """Enabled plugins implementing get_reports contribute their cards."""
+    pm = app.extensions['plugin_manager']
+    monkeypatch.setattr(pm.registry, 'is_enabled', lambda name: True)
+
+    reports, ids = _report_ids(client, auth_headers)
+    # warranty + printers implement get_reports
+    assert 'warranty' in ids
+    assert 'toner' in ids
+    # merged cards carry their originating plugin name
+    warranty_card = next(r for r in reports if r['id'] == 'warranty')
+    assert warranty_card['plugin'] == 'warranty'
+    assert warranty_card['route'] == '/reports/warranty'
+
+
+def test_disabled_plugin_reports_drop_out(app, client, auth_headers, monkeypatch):
+    """A disabled plugin's report cards disappear from the list."""
+    pm = app.extensions['plugin_manager']
+    monkeypatch.setattr(pm.registry, 'is_enabled', lambda name: name != 'warranty')
+
+    _, ids = _report_ids(client, auth_headers)
+    assert 'warranty' not in ids
+    assert 'toner' in ids  # printers still enabled