Buildings and levels for the floor map, and make every identifier searchable

The map was one picture of one floor. A second floor was added, the blueprint
changed size, and machines moved, so a position now records WHICH DRAWING its
coordinates belong to.

Buildings and levels (ADR-017). Each level owns its blueprint per theme and its
own native pixel size; assets.mapx/mapy are pixels of assets.levelid, not of the
site. A position whose level is unknown renders "level unknown" and is never
drawn on the default level, because a marker on the wrong floor plan looks
entirely correct while pointing at the wrong place.

Repositioning in bulk: filter by unplaced, needs-review or level, search, place,
confirm. Landmark recalibration solves the transform PER AXIS from landmark
pairs and never from image dimensions - the canvas grew taller without
rescaling, so a dimension-derived scale would stretch Y by 1.57 and be wrong
everywhere. It defaults to a dry run, reports what would land off the drawing,
snapshots before applying, and clears mapverifiedat because a transform is a
guess awaiting review. Snapshots restore, including the level and the review
state, and a restore snapshots first so an undo is undoable.

Search: gaugelabreference was matched only for measuring tools and
maintenancereference was matched nowhere at all, for any asset type, while
Settings happily offers both identifiers on machines and PCs. A tag an operator
is told to record has to be findable or it is a write-only field. USB devices
and printed items were unreachable from search entirely - neither is an asset,
so the generic asset search could not see them and no searcher existed; they
now match on serial, asset tag, label, bin code and gage-lab tag, honouring
isactive, with Settings toggles and result labels to match.

The retired-application rule was half a rule: GET /api/knowledgebase hid
articles whose topic application is retired while global search still returned
them and printed the retired application as the subject. A filter is only real
if every path that reaches the row applies it.

Contract to 0.20.0 (additive): Asset gained levelid and mapverifiedat, Location
gained levelid, and resolve_asset_position returns the levelid belonging to
whichever source supplied the coordinates. The five plugins that write a map
position are re-pinned. The install-list text format gained levelid as a NINTH
field, appended, because the shipped Pascal installer reads fields 0-7 by index.

That installer still compiles in one drawing's dimensions and bundles one
blueprint, so its map is accurate for the default level only; /api/maplevels is
deliberately unauthenticated so it can read both at runtime once rebuilt.
Recorded in PRINTER-INSTALLER.md section 6 along with the other known gaps.

Migration 7d33 converts an existing single-map site into one building and one
default level carrying the old map_* settings, then assigns every placed asset
and location to it. Nothing moves on screen. Old settings rows are kept so a
rollback still finds them. Verified end to end on MySQL 5.6 from a
production-shaped database.

docs/PROJECT-MAP.md

@@ -12,7 +12,7 @@ never by editing this file.
 | series | value | governed by |
 |---|---|---|
 | product `__version__` | `0.10.0` | ADR-007 |
-| plugin contract `__contract_version__` | `0.19.0` | ADR-002 |
+| plugin contract `__contract_version__` | `0.20.0` | ADR-002 |
 
 They move independently. A contract bump is not a release.
 
@@ -23,7 +23,7 @@ with `flask plugin upgrade-all`. Both are needed on a deploy.
 
 | chain | head |
 |---|---|
-| core | `7d32_displayrole_kiosk_vocabulary` |
+| core | `7d33_buildings_and_levels` |
 | backups | `backups0003clearlastseen` |
 | computers | `computers0001anchor` |
 | employees | `employees0002photo` |
@@ -44,16 +44,16 @@ with `flask plugin upgrade-all`. Both are needed on a deploy.
 | plugin | version | core_version | owns migrations |
 |---|---|---|---|
 | backups | 1.0.0 | >=0.16.0,<1.0.0 | yes |
-| computers | 1.0.0 | >=0.1.0,<1.0.0 | yes |
+| computers | 1.0.0 | >=0.20.0,<1.0.0 | yes |
 | employees | 1.0.0 | >=0.1.0,<1.0.0 | yes |
 | geenforce | 0.1.0 | >=0.18.0,<1.0.0 | yes |
 | knowledgebase | 1.0.0 | >=0.1.0,<1.0.0 | yes |
-| machines | 1.0.0 | >=0.1.0,<1.0.0 | yes |
-| measuringtools | 1.0.0 | >=0.6.0,<1.0.0 | yes |
-| network | 1.0.0 | >=0.1.0,<1.0.0 | yes |
+| machines | 1.0.0 | >=0.20.0,<1.0.0 | yes |
+| measuringtools | 1.0.0 | >=0.20.0,<1.0.0 | yes |
+| network | 1.0.0 | >=0.20.0,<1.0.0 | yes |
 | notifications | 1.0.0 | >=0.1.0,<1.0.0 | yes |
 | printedparts | 0.1.0 | >=0.16.0,<1.0.0 | yes |
-| printers | 1.0.0 | >=0.16.0,<1.0.0 | yes |
+| printers | 1.0.0 | >=0.20.0,<1.0.0 | yes |
 | slides | 2.0.0 | >=0.2.0,<1.0.0 | yes |
 | tools | 1.0.0 | >=0.16.0,<1.0.0 | no |
 | usb | 1.0.0 | >=0.1.0,<1.0.0 | yes |
@@ -81,9 +81,10 @@ Manifest-less directories under `plugins/` are core frontend surface and always
 | ADR-014-schema-lean-per-site.md | ADR-014: Schema-lean per-site builds (retire cross-plugin FKs, lift plugin tables) | ACCEPTED |
 | ADR-015-site-specific-configuration.md | ADR-015: Where a site's own data is allowed to live | ACCEPTED |
 | ADR-016-credential-delivery.md | ADR-016: Credential delivery to the fleet | ACCEPTED (decided; NOT yet implemented - |
+| ADR-017-buildings-and-levels.md | ADR-017: Buildings and levels as the map model | ACCEPTED |
 
 ## Size
 
-- test functions defined: **1050** (parametrised cases collect higher)
-- documented API paths: **265** (`docs/openapi.json`, regenerate with `scripts/gen_openapi.py`)
+- test functions defined: **1084** (parametrised cases collect higher)
+- documented API paths: **276** (`docs/openapi.json`, regenerate with `scripts/gen_openapi.py`)