Buildings and levels for the floor map, and make every identifier searchable

The map was one picture of one floor. A second floor was added, the blueprint
changed size, and machines moved, so a position now records WHICH DRAWING its
coordinates belong to.

Buildings and levels (ADR-017). Each level owns its blueprint per theme and its
own native pixel size; assets.mapx/mapy are pixels of assets.levelid, not of the
site. A position whose level is unknown renders "level unknown" and is never
drawn on the default level, because a marker on the wrong floor plan looks
entirely correct while pointing at the wrong place.

Repositioning in bulk: filter by unplaced, needs-review or level, search, place,
confirm. Landmark recalibration solves the transform PER AXIS from landmark
pairs and never from image dimensions - the canvas grew taller without
rescaling, so a dimension-derived scale would stretch Y by 1.57 and be wrong
everywhere. It defaults to a dry run, reports what would land off the drawing,
snapshots before applying, and clears mapverifiedat because a transform is a
guess awaiting review. Snapshots restore, including the level and the review
state, and a restore snapshots first so an undo is undoable.

Search: gaugelabreference was matched only for measuring tools and
maintenancereference was matched nowhere at all, for any asset type, while
Settings happily offers both identifiers on machines and PCs. A tag an operator
is told to record has to be findable or it is a write-only field. USB devices
and printed items were unreachable from search entirely - neither is an asset,
so the generic asset search could not see them and no searcher existed; they
now match on serial, asset tag, label, bin code and gage-lab tag, honouring
isactive, with Settings toggles and result labels to match.

The retired-application rule was half a rule: GET /api/knowledgebase hid
articles whose topic application is retired while global search still returned
them and printed the retired application as the subject. A filter is only real
if every path that reaches the row applies it.

Contract to 0.20.0 (additive): Asset gained levelid and mapverifiedat, Location
gained levelid, and resolve_asset_position returns the levelid belonging to
whichever source supplied the coordinates. The five plugins that write a map
position are re-pinned. The install-list text format gained levelid as a NINTH
field, appended, because the shipped Pascal installer reads fields 0-7 by index.

That installer still compiles in one drawing's dimensions and bundles one
blueprint, so its map is accurate for the default level only; /api/maplevels is
deliberately unauthenticated so it can read both at runtime once rebuilt.
Recorded in PRINTER-INSTALLER.md section 6 along with the other known gaps.

Migration 7d33 converts an existing single-map site into one building and one
default level carrying the old map_* settings, then assigns every placed asset
and location to it. Nothing moves on screen. Old settings rows are kept so a
rollback still finds them. Verified end to end on MySQL 5.6 from a
production-shaped database.

docs/PRINTER-INSTALLER.md

@@ -46,19 +46,30 @@ Fields per row:
 | `installpath` | Installer path for this printer (see install-batch). |
 | `iscsf` | CSF flag. |
 | `locationname` | Location name, if the asset has one. |
-| `mapx` / `mapy` | Floor-map hotspot position. |
+| `mapx` / `mapy` | Floor-map hotspot position, in the native pixels of `levelid`. |
+| `levelid` | Which level (drawing) those pixels belong to. Null when unplaced. |
 
 `?format=text` returns a pipe-delimited line per printer, one printer per line,
 with a fixed field order so the Inno / Pascal installer does a `split()` instead
 of parsing JSON:
 
 ```
-printerid|windowsname|vendorname|modelnumber|hostname|ipaddress|mapx|mapy
+printerid|windowsname|vendorname|modelnumber|hostname|ipaddress|mapx|mapy|levelid
 ```
 
 Any pipe or newline inside a value is neutralized to a space so the field count
 stays fixed. The web map uses the default JSON.
 
+**Fields 0-7 are frozen.** The shipped installer reads them positionally
+(`GetField(Line, 6)` is mapx), so a new field goes on the END and nowhere else -
+inserting one shifts every later field and the installer keeps running while
+reading a model number as a coordinate. `levelid` is field 8 for that reason, and
+installers built before levels existed ignore it.
+
+An installer that ignores `levelid` draws every printer on whichever single
+blueprint it ships, which is correct only while a site has one level. See
+ADR-017 and section 6.
+
 ---
 
 ## 3. `GET /api/printers/pc-default?machine=NNNN`
@@ -102,3 +113,27 @@ name / number.
 The `common` scope's `printer map` manifest entry (see `GE-ENFORCE-DISPLAY.md`)
 lays down the signed installer that consumes these endpoints. The web map page
 covers the same install flow for a human at a browser.
+
+---
+
+## 6. The shipped installer predates levels (known gap)
+
+The Pascal installer in the `inno` repo (`PrinterInstallerMap`) still assumes one
+drawing per site, in two places that must change together:
+
+- `MAP_SOURCE_W = 3300` / `MAP_SOURCE_H = 2550` are compiled-in constants, and
+  every hotspot is scaled by them. They are the dimensions of ONE level.
+- A downsized copy of that level's blueprint is bundled into the installer
+  (`880x680`), so the picture is fixed at build time.
+
+Two consequences, neither of which the installer can detect:
+
+1. It ignores field 8, so printers on any level are drawn on the bundled image.
+   Coordinates from a different drawing land somewhere plausible and wrong.
+2. When a level's blueprint is replaced with one of different dimensions, the
+   constants and the bundled image are both stale and every hotspot shifts.
+
+The API side is ready: `GET /api/maplevels` is deliberately unauthenticated so
+the installer can fetch level dimensions and blueprint URLs at runtime rather
+than compiling them in, which is what fixes both. Until the installer is
+rebuilt against it, treat its map as accurate for the default level only.