Fix fresh-install migration blocker + add preflight, seed admin, first-run endpoints

Validated a clean install on MySQL 5.6 end to end and fixed the blockers.

- migrations/env.py: force alembic_version.version_num to VARCHAR(128) in its
  own committed connection before running migrations. It was VARCHAR(32); the
  revision id 7d02_widen_notification_employee_cols (37 chars) truncated, so the
  next migration's version bump matched 0 rows and `flask db upgrade` died at
  7d03 on a fresh DB. Now upgrades run clean to head.
- flask db-utils preflight: checks Python, required env, DB connectivity, and
  the MySQL 5.6 utf8mb4 index flags (innodb_large_prefix/Barracuda) - the 767
  prerequisite - and prints exact fixes. Exits non-zero on blockers.
- flask seed admin --username --email [--password]: real first-admin command
  (generates + prints a password once). The docs referenced it but only the
  dev-only test-user existed.
- setup endpoints for a UI-driven first run: /setup/needs-admin,
  /setup/create-admin (guarded to zero-users), /setup/seed-reference.
- Wizard: drop the PC-access-domain question (always .device.geaerospace.net);
  the setting keeps its default.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

shopdb/cli/__init__.py

@@ -20,6 +20,91 @@ def create_all():
     click.echo(click.style("All tables created.", fg='green'))
 
 
+@db_cli.command('preflight')
+@with_appcontext
+def preflight():
+    """Check install prerequisites before `flask db upgrade`.
+
+    Reports what must be fixed/installed (Python, required env, DB connectivity,
+    and the MySQL 5.6 utf8mb4 index flags). Exits non-zero if anything blocks.
+    """
+    import sys
+    import os
+    from sqlalchemy import text
+    from flask import current_app
+    from shopdb.extensions import db
+
+    failures = []
+    warnings = []
+
+    def ok(msg):
+        click.echo(click.style('  PASS ', fg='green') + msg)
+
+    def fail(msg, fix):
+        failures.append((msg, fix))
+        click.echo(click.style('  FAIL ', fg='red') + msg)
+        click.echo(click.style('       fix: ', fg='red') + fix)
+
+    def warn(msg, fix):
+        warnings.append((msg, fix))
+        click.echo(click.style('  WARN ', fg='yellow') + msg)
+        click.echo(click.style('       ', fg='yellow') + fix)
+
+    click.echo(click.style('ShopDB preflight', bold=True))
+
+    # Python
+    py = sys.version_info
+    if py >= (3, 9):
+        ok(f'Python {py.major}.{py.minor}.{py.micro}')
+    else:
+        fail(f'Python {py.major}.{py.minor} is too old',
+             'Install Python 3.9 or newer.')
+
+    # Required config
+    for key in ('SECRET_KEY', 'JWT_SECRET_KEY', 'DATABASE_URL'):
+        value = current_app.config.get(key) or os.environ.get(key)
+        if value and 'change' not in str(value).lower() and 'dev-' not in str(value).lower():
+            ok(f'{key} is set')
+        else:
+            fail(f'{key} is missing or a dev default',
+                 f'Set {key} in .env (64+ random chars for the secrets).')
+
+    # DB connectivity + MySQL index prerequisites
+    try:
+        version = db.session.execute(text('SELECT VERSION()')).scalar()
+        ok(f'Database reachable (MySQL {version})')
+    except Exception as exc:
+        fail('Cannot connect to the database', f'Check DATABASE_URL / server. ({exc})')
+        version = ''
+
+    if version and version.startswith('5.6'):
+        variables = {}
+        for name in ('innodb_large_prefix', 'innodb_file_format', 'innodb_file_per_table'):
+            try:
+                row = db.session.execute(text(f"SHOW VARIABLES LIKE '{name}'")).fetchone()
+                variables[name] = row[1] if row else None
+            except Exception:
+                variables[name] = None
+        needed = {'innodb_large_prefix': 'ON', 'innodb_file_format': 'Barracuda',
+                  'innodb_file_per_table': 'ON'}
+        bad = [n for n, want in needed.items() if str(variables.get(n)).lower() != want.lower()]
+        if bad:
+            fail('MySQL 5.6 index flags not set: ' + ', '.join(bad),
+                 'Add to my.cnf [mysqld]: innodb_file_per_table=1, '
+                 'innodb_file_format=Barracuda, innodb_large_prefix=1 (then restart). '
+                 'Otherwise `flask db upgrade` fails with error 1071.')
+        else:
+            ok('MySQL 5.6 index flags OK (Barracuda + large_prefix)')
+    elif version:
+        ok('MySQL 5.7+/8.0 - no extra index flags needed')
+
+    click.echo('')
+    if failures:
+        click.echo(click.style(f'{len(failures)} blocker(s). Fix them before installing.', fg='red', bold=True))
+        raise SystemExit(1)
+    click.echo(click.style('All prerequisites met.' + (f' ({len(warnings)} warning(s))' if warnings else ''), fg='green', bold=True))
+
+
 @db_cli.command('drop-all')
 @click.confirmation_option(prompt='This will delete ALL data. Are you sure?')
 @with_appcontext
@@ -204,6 +289,49 @@ def seed_test_user():
         click.echo(click.style("Test user already exists", fg='yellow'))
 
 
+@seed_cli.command('admin')
+@click.option('--username', required=True, help='Admin login username')
+@click.option('--email', required=True, help='Admin email address')
+@click.option('--password', default=None,
+              help='Admin password. Omit to generate a strong one and print it once.')
+@with_appcontext
+def seed_admin(username, email, password):
+    """Create the first admin user for a new site.
+
+    Password is generated and printed ONCE if not supplied. Store it safely.
+    """
+    import secrets
+    from shopdb.extensions import db
+    from shopdb.core.models import User, Role
+    from werkzeug.security import generate_password_hash
+
+    if User.query.filter_by(username=username).first():
+        click.echo(click.style(f'User "{username}" already exists.', fg='yellow'))
+        return
+
+    admin_role = Role.query.filter_by(rolename='admin').first()
+    if not admin_role:
+        admin_role = Role(rolename='admin', description='Administrator')
+        db.session.add(admin_role)
+
+    generated = password is None
+    if generated:
+        password = secrets.token_urlsafe(12)
+
+    user = User(username=username, email=email,
+                passwordhash=generate_password_hash(password), isactive=True)
+    user.roles.append(admin_role)
+    db.session.add(user)
+    db.session.commit()
+
+    click.echo(click.style(f'Admin "{username}" created.', fg='green'))
+    if generated:
+        click.echo(click.style('=' * 52, fg='cyan'))
+        click.echo(click.style(f'  Password: {password}', fg='cyan', bold=True))
+        click.echo(click.style('  Store this now - it will not be shown again.', fg='cyan'))
+        click.echo(click.style('=' * 52, fg='cyan'))
+
+
 @seed_cli.command('permissions')
 @with_appcontext
 def seed_permissions():