Document external-DB schema contracts for employees + USB plugins

Every site's HR directory and USB check-in/out databases may use a different
schema, so document exactly what each plugin queries and how to adapt.

- plugins/employees/README.md: required employees table columns (SSO,
  First_Name, Last_Name, Team, Role, Picture), the queries run, photo handling,
  and a CREATE VIEW recipe to map a different site schema without code changes.
- plugins/usb/README.md: cmmc_usb devices / checkinoutlog / users columns,
  read-write ops, the employee-directory dependency, and a view recipe.
- USB plugin gains get_config_schema() (cmmc_usb_db_host/name/user + password);
  cmmc_usb_connection reads host/name/user settings-first (env fallback), the
  password stays env-only - matching the employees plugin.
- Config-field help points at the READMEs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/usb/plugin.py

@@ -55,7 +55,24 @@ class USBPlugin(BasePlugin):
     def get_models(self) -> List[Type]:
         """Return list of SQLAlchemy model classes."""
         return [USBDeviceType, USBDevice, USBCheckout]
-    
+
+    def get_config_schema(self) -> List[Dict]:
+        """CMMC USB check-in/out database connection. Host/name/user are settings
+        the wizard can edit; the password stays in .env (emitted, not stored)."""
+        return [
+            {'key': 'cmmc_usb_db_host', 'label': 'USB DB host', 'type': 'text',
+             'secret': False, 'default': 'localhost',
+             'help': 'This DB must expose devices / checkinoutlog / users tables '
+                     '(or views). See plugins/usb/README.md.'},
+            {'key': 'cmmc_usb_db_name', 'label': 'USB DB name', 'type': 'text',
+             'secret': False, 'default': 'cmmc_usb'},
+            {'key': 'cmmc_usb_db_user', 'label': 'USB DB user', 'type': 'text',
+             'secret': False},
+            {'key': 'cmmc_usb_db_password', 'label': 'USB DB password', 'type': 'password',
+             'secret': True, 'envvar': 'CMMC_USB_DB_PASSWORD',
+             'help': 'Stored in .env, not the database. The wizard shows the line to paste.'},
+        ]
+
     def init_app(self, app: Flask, db_instance) -> None:
         """Initialize plugin with Flask app."""
         logger.info(f"USB plugin initialized (v{self.meta.version})")