Windows installer: payload hash-locking, SBOM, client-IP handling, operator docs

plugins/employees/api/routes.py

@@ -153,7 +153,7 @@ def resolve_employee_display_name(sso):
     #    location not carried in the directory). Their name lives on the User
     #    record; GE usernames are the SSO. Photo still falls back to the GE mark.
     try:
-        from shopdb.core.models import User
+        from shopdb.api import User
         user = User.query.filter_by(username=str(sso)).first()
         if user:
             name = f'{(user.firstname or "").strip()} {(user.lastname or "").strip()}'.strip()