Self-hosted employee directory (in-app management + CSV import)

Most sites have no external HR database, so add a self-hosted directory mode.

- New employee_directory_mode setting: 'external' (default; read a separate HR
  DB, unchanged) or 'selfhosted' (app-owned table).
- DirectoryEmployee model + directoryemployees table (migration 7d16). to_dict
  emits the same keys the external contract uses (SSO/First_Name/...), so both
  modes share one response shape and the frontend is unchanged.
- Employee search / single / batch lookup branch on the mode.
- Self-hosted-only management endpoints: list, create, update, delete, and CSV
  import (upsert by SSO). Guarded so they only work in self-hosted mode.
- EmployeeDirectory.vue management page (Settings > Locations & Organization):
  table + search + pagination, add/edit/delete, CSV import (file or paste).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/usb/README.md

@@ -9,11 +9,12 @@ The plugin's own reference tables (`usbdevicetypes`, `usbdevices`,
 `usbcheckouts`) live in the main app database; only the live check-in/out data
 is in `cmmc_usb`.
 
-> **This schema is typically standardized across sites** - the `cmmc_usb`
-> check-in/out solution is the same deployment everywhere, so the tables below
-> usually match as-is and no adaptation is needed. The view recipe at the end is
-> a fallback for the rare site that differs. (Contrast the employee directory,
-> which genuinely varies per site.)
+> **The schema is standardized across sites** - the `cmmc_usb` check-in/out
+> solution is the same deployment everywhere, so the tables below match as-is
+> and no schema adaptation is needed. The **database name may differ per site**,
+> though - set `cmmc_usb_db_name` (default `cmmc_usb`) to match the local name.
+> The view recipe at the end is only a fallback for a site that somehow differs.
+> (Contrast the employee directory, which genuinely varies per site.)
 
 ## Connection