Document external-DB schema contracts for employees + USB plugins

Every site's HR directory and USB check-in/out databases may use a different
schema, so document exactly what each plugin queries and how to adapt.

- plugins/employees/README.md: required employees table columns (SSO,
  First_Name, Last_Name, Team, Role, Picture), the queries run, photo handling,
  and a CREATE VIEW recipe to map a different site schema without code changes.
- plugins/usb/README.md: cmmc_usb devices / checkinoutlog / users columns,
  read-write ops, the employee-directory dependency, and a view recipe.
- USB plugin gains get_config_schema() (cmmc_usb_db_host/name/user + password);
  cmmc_usb_connection reads host/name/user settings-first (env fallback), the
  password stays env-only - matching the employees plugin.
- Config-field help points at the READMEs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

shopdb/utils/cmmc_usb_db.py

@@ -11,12 +11,28 @@ import pymysql
 from flask import current_app
 
 
+def _setting_or_config(setting_key, config_key):
+    """Non-secret config: a saved Setting wins, else the env-backed app config.
+
+    Lets the setup wizard edit host/name/user without touching .env, while the
+    password stays env-only.
+    """
+    from shopdb.core.models import Setting
+    try:
+        row = Setting.query.filter_by(key=setting_key).first()
+        if row and row.value:
+            return row.value
+    except Exception:
+        pass
+    return current_app.config[config_key]
+
+
 def cmmc_usb_connection():
     """Open a pymysql connection to the cmmc_usb DB."""
     return pymysql.connect(
-        host=current_app.config['CMMC_USB_DB_HOST'],
-        user=current_app.config['CMMC_USB_DB_USER'],
+        host=_setting_or_config('cmmc_usb_db_host', 'CMMC_USB_DB_HOST'),
+        user=_setting_or_config('cmmc_usb_db_user', 'CMMC_USB_DB_USER'),
         password=current_app.config['CMMC_USB_DB_PASSWORD'],
-        database=current_app.config['CMMC_USB_DB_NAME'],
+        database=_setting_or_config('cmmc_usb_db_name', 'CMMC_USB_DB_NAME'),
         cursorclass=pymysql.cursors.DictCursor,
     )