Plugin framework maturation, reports overhaul, theming, and USB frontend repair

Framework:
- Per-plugin Alembic migration chains (ADR-008): every bundled plugin
  carries its own chain with a stamp-only anchor at the ownership cutover;
  new plugin schema lands in plugins/<name>/migrations/, never the core
  chain. Deploys add flask plugin upgrade-all. Fixed a latent bug in the
  shared alembic template (engine URL resolution) and taught the metadata
  filter to include FK-referenced core tables.
- Frontend plugin route gating (ADR-009): plugin routes carry meta.plugin;
  a disabled plugin's pages redirect to the dashboard via a cached,
  fail-open check against the new public GET /api/plugins/enabled.
- get_reports() plugin hook (contract 0.5.0 -> 0.6.0): plugins contribute
  report cards; warranty and toner cards moved off the hardcoded list.

Reports:
- Hub grouped by category with search; inline reports render at the top,
  are URL-backed (?report=id, back-button and deep links work), expose
  their server-side filter params as controls, and export CSV. Warranty
  and Toner pages gained CSV export.
- Deleted the dead legacy Warranty Status report (always-zero buckets
  from a retired column).

Theming and fonts:
- Inter (variable) bundled locally via @fontsource, replacing the Google
  Fonts Roboto import - air-gapped installs now render correctly; tables
  use tabular numerals.
- Optional brand_primary_dark_color, brand_accent_color,
  brand_sidebar_color settings applied to CSS vars at bootstrap.

USB frontend repair (views were reading a dead legacy shape):
- List/detail/form and the employee profile USB panels remapped to the
  real API shape (device_id/device_desc/checkinoutlog); employee panels
  now use /usb/checkouts endpoints; external-mode /usb/checkouts/active
  honors the badge filter; dead client methods pruned.

Also: warranties list page no longer requires login (matches app
convention); collector doc rewritten with a GE-Enforce integration guide
and paste-ready PowerShell reporter; ADR index and CHANGELOG updated.

Verified: 323 tests pass, naming/style green, frontend builds, plugin
migration dry-run green on scratch MySQL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_plugin_contract.py

@@ -137,6 +137,25 @@ def test_baseplugin_has_dashboard_widgets_hook():
     assert hasattr(BasePlugin, 'get_dashboard_widgets')
 
 
+def test_baseplugin_has_reports_hook():
+    """The reports hook is on the contract surface (contract 0.6.0)."""
+    assert hasattr(BasePlugin, 'get_reports')
+
+
+@pytest.mark.parametrize('name', BUNDLED_PLUGINS)
+def test_plugin_get_reports_is_iterable(plugin_instances, name):
+    """get_reports returns a list (default empty)."""
+    plugin = plugin_instances[name]
+    reports = plugin.get_reports()
+    assert isinstance(reports, list)
+    # Each card carries an id/name/category plus exactly one of route/endpoint.
+    for card in reports:
+        assert card.get('id') and card.get('name') and card.get('category')
+        assert ('route' in card) ^ ('endpoint' in card), (
+            f'{name} report card must have exactly one of route/endpoint'
+        )
+
+
 def test_get_services_hook_has_consumer(app):
     """get_services is consumed by plugin_manager.get_service (no dead hook)."""
     with app.app_context():
@@ -187,7 +206,11 @@ _PLUGIN_IMPORT_RE = re.compile(
 
 def _plugin_source_files():
     root = Path(__file__).resolve().parent.parent / 'plugins'
-    return [p for p in root.rglob('*.py') if '__pycache__' not in p.parts]
+    # Skip migrations/ - Alembic env.py is framework glue that legitimately
+    # calls the shared runner in shopdb.plugins.alembic_template (see ADR-008),
+    # not plugin domain code. Mirrors the style check excluding versions/.
+    return [p for p in root.rglob('*.py')
+            if '__pycache__' not in p.parts and 'migrations' not in p.parts]
 
 
 def test_plugins_only_import_contract_surface():