Windows installer: payload hash-locking, SBOM, client-IP handling, operator docs

CHANGELOG.md

@@ -12,6 +12,54 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- Air-gapped Windows installer (`deploy/windows/installer/`). One `.exe` per
+  site, built from that site's plugin profile, containing Python, the wheels,
+  the SPA, the IIS modules and optionally MySQL. Operator docs:
+  `docs/INSTALL-WINDOWS.md` and `docs/OPERATE-WINDOWS.md`, both shipped onto the
+  server. `docs/INSTALL-WINDOWS-IIS.md` and `docs/DEPLOY-WINDOWS-IIS.md` are now
+  reference-only, for hand-built servers.
+- `bundle-lock.json`: an exact sha256 + size record of the installer's
+  third-party payload (wheels, Python installer, IIS MSIs). Verified as set
+  equality by both builders and again on the server before anything runs; there
+  is no install-time override. Regenerate with `refresh-bundle-lock.ps1`.
+- CycloneDX SBOM (`sbom.cdx.json`) generated on every build from
+  `requirements.txt` and `package-lock.json`, covering both ecosystems, staged
+  into the application tree so an air-gapped server can answer "do we carry this
+  component" locally: `shopdb-admin.ps1 verify -Path <name>`.
+- `shopdb-admin.ps1`, the operator console: status, start/stop/restart, logs,
+  health check, backup, plugins, verify. `check -Json` emits secret-free
+  structured state for pasting into a support ticket or an AI assistant.
+- `build-installer.ps1`, the whole build natively on Windows, so a work PC needs
+  no Bash. Shares `scripts/resolve_plugin_closure.py` with `build-site.sh`.
+- URL Rewrite is bundled and the wizard asks where client IPs come from
+  (`-ClientIpSource direct|proxy`). Without the rule IIS sends no
+  `X-Forwarded-For` at all and every client reads as 127.0.0.1.
+
+### Changed
+
+- `requirements.txt` and `requirements-dev.txt` are compiled `--universal
+  --generate-hashes`. Installs run under `pip --require-hashes`, so a wheel whose
+  sha256 is not listed is refused. The dev lockfile is constrained to the
+  production pins; the two had drifted.
+- Python 3.14 across the Dockerfile, CI, `web.config` and the docs, which
+  previously declared four different versions.
+- The naming/style gate covers Markdown, JSON and YAML, not just code.
+
+### Fixed
+
+- `plugins/employees` imported `shopdb.core.models` directly, failing the
+  contract-surface test on `main` since the dashboard employee-name resolver
+  landed.
+- `scripts/build-site.sh` copied all of `deploy/` into its own output directory,
+  which recursed when the output was staged inside it - the documented Windows
+  build could not complete.
+- Plugin baseline migrations inherited the MySQL server's default charset: the
+  utf8mb4 compiler hook lived in `migrations/env.py` and so covered the core
+  chain only. It is now `shopdb/utils/mysql_charset.py`, imported by both.
+  `flask db-utils preflight` reports the database's default charset.
+
+### Added
+
 - Configurable site timezone: a `site_timezone` site setting (default
   `America/New_York`, public-readable), editable in Settings > Site >
   Localization. Notification start/end times are entered and displayed in this
@@ -53,7 +101,7 @@ ADR-007 and ADR-002.
 - Shopfloor kiosk header text is readable (light on the dark navy header).
 
 
-### Added
+### Added (continued)
 
 - Collector-driven PC -> printer relationships. The computers collector schema
   gained optional `defaultprinter` (string) and `printers` (array of strings)