Document external-DB schema contracts for employees + USB plugins

Every site's HR directory and USB check-in/out databases may use a different
schema, so document exactly what each plugin queries and how to adapt.

- plugins/employees/README.md: required employees table columns (SSO,
  First_Name, Last_Name, Team, Role, Picture), the queries run, photo handling,
  and a CREATE VIEW recipe to map a different site schema without code changes.
- plugins/usb/README.md: cmmc_usb devices / checkinoutlog / users columns,
  read-write ops, the employee-directory dependency, and a view recipe.
- USB plugin gains get_config_schema() (cmmc_usb_db_host/name/user + password);
  cmmc_usb_connection reads host/name/user settings-first (env fallback), the
  password stays env-only - matching the employees plugin.
- Config-field help points at the READMEs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/employees/plugin.py

@@ -63,7 +63,10 @@ class EmployeesPlugin(BasePlugin):
         wizard can edit; the password stays in .env (emitted, not stored)."""
         return [
             {'key': 'employee_db_host', 'label': 'Employee DB host', 'type': 'text',
-             'secret': False, 'default': 'localhost'},
+             'secret': False, 'default': 'localhost',
+             'help': 'This DB must expose an "employees" table or view with columns '
+                     'SSO, First_Name, Last_Name, Team, Role, Picture. '
+                     'See plugins/employees/README.md.'},
             {'key': 'employee_db_name', 'label': 'Employee DB name', 'type': 'text',
              'secret': False, 'default': 'wjf_employees'},
             {'key': 'employee_db_user', 'label': 'Employee DB user', 'type': 'text',