Add flask seed demo sample-data command

New dev/eval seeder populates a small, broad dataset so a fresh site has
something on every screen: ~25 assets across machines, computers,
printers, network devices, and measuring tools, plus supporting
vendors/business-units/locations, six 3D-printed parts (two below their
low-stock threshold to exercise the alert), and a few relationships for
the map and relationship cards. Idempotent, keyed on a DEMO- assetnumber
prefix; skips the plugin sections that are not installed.

`flask seed demo-clear` removes exactly what it created: bulk-deletes the
DEMO- assets so the DB-level ON DELETE CASCADE drops each plugin subtype
row (per-object ORM delete would try to NULL the NOT NULL child assetid),
after clearing the demo relationships first. Leaves reference data,
settings, users, and any imported rows untouched.

Documented as an optional step in the dev setup guide.

docs/DEVELOPMENT-SETUP.md

@@ -45,6 +45,41 @@ identically across 20-24, so it does not matter. To pin exactly:
 
 ---
 
+## 0b. Corp network (SSL cert) - if you are behind a GE/Zscaler proxy
+
+A proxy that inspects HTTPS (Zscaler on GE PCs) re-signs every connection
+with a corporate root CA. `git`, `npm`, `pip`, and Node each keep their own
+trust store and do not trust that CA by default, so downloads fail:
+
+| Tool | Symptom |
+| --- | --- |
+| npm | `UNABLE_TO_GET_ISSUER_CERT_LOCALLY` |
+| git | `SSL certificate problem: unable to get local issuer certificate` |
+| pip | `SSLError` / `CERTIFICATE_VERIFY_FAILED` |
+
+Fix once - export the corp root CA, point every tool at it. PowerShell
+mangles multi-line pastes, so each step below is **one physical line**: paste
+it, press Enter, then the next. Do not paste both at once.
+
+```powershell
+# 1) Bundle EVERY trusted root into one PEM (one line). Guessing which single cert is the proxy's is fragile; bundling all always includes it.
+$sb = New-Object System.Text.StringBuilder; Get-ChildItem Cert:\LocalMachine\Root | ForEach-Object { [void]$sb.AppendLine("-----BEGIN CERTIFICATE-----"); [void]$sb.AppendLine([Convert]::ToBase64String($_.RawData,'InsertLineBreaks')); [void]$sb.AppendLine("-----END CERTIFICATE-----") }; [IO.File]::WriteAllText("$HOME\corp-root-ca.pem", $sb.ToString())
+```
+
+Confirm it has many certs (dozens, not 1):
+`(Select-String "BEGIN CERTIFICATE" $HOME\corp-root-ca.pem).Count`
+
+```powershell
+# 2) Point every tool at it (one line, persistent). NODE_EXTRA_CA_CERTS also fixes Vite / npm run dev.
+git config --global http.sslCAInfo "$HOME\corp-root-ca.pem"; npm config set cafile "$HOME\corp-root-ca.pem"; setx NODE_EXTRA_CA_CERTS "$HOME\corp-root-ca.pem"; setx PIP_CERT "$HOME\corp-root-ca.pem"
+```
+
+Reopen the terminal so `setx` takes effect. Quick unblock if you cannot
+export right now (skips verification - use briefly, then set back):
+`npm config set strict-ssl false`, `git config --global http.sslVerify false`.
+
+---
+
 ## 1. Get the code
 
 ```powershell
@@ -76,6 +111,7 @@ docker compose exec api flask seed permissions
 docker compose exec api flask seed settings
 docker compose exec api flask seed reference-data
 docker compose exec api flask seed admin --username admin --email you@example.com
+docker compose exec api flask seed demo    # OPTIONAL: sample data (undo: flask seed demo-clear)
 ```
 
 The app is on the port the compose file maps (see `docker-compose.yml`). Good
@@ -125,6 +161,7 @@ flask seed permissions
 flask seed settings
 flask seed reference-data
 flask seed admin --username admin --email you@example.com   # password printed once
+flask seed demo            # OPTIONAL: ~25 sample assets across plugins + printed parts (undo: flask seed demo-clear)
 ```
 
 Enable the plugins you want visible (they install on a fresh box; some ship
@@ -149,7 +186,13 @@ Run the backend ON PORT 5001 - the frontend dev server proxies `/api` and
 flask run --port 5001
 ```
 
-### Frontend (a second terminal)
+**Leave this running.** `flask run` does not return to a prompt - that is
+correct, not a hang. The server holds this terminal until you stop it. Do
+NOT press Ctrl+C to move on; that kills the backend. Open the frontend in a
+separate terminal (next section) and leave this one alone. Ctrl+C only when
+you are done for the day.
+
+### Frontend (a second terminal - leave the backend running)
 
 ```powershell
 cd frontend
@@ -253,5 +296,6 @@ section of the plugin lab for the full review checklist.
 | `flask db upgrade` error 1071 (key too long) | MySQL 5.6 without the `innodb_large_prefix`/Barracuda flags; use MySQL 8 for dev. |
 | Nav missing Machines/PCs/... | plugins not installed/enabled (step 2b), or the backend not restarted after enabling. |
 | "No time zone found with key America/New_York" | `tzdata` not installed - `pip install -r requirements.txt` includes it. |
+| npm/git/pip SSL error (`UNABLE_TO_GET_ISSUER_CERT_LOCALLY`, `unable to get local issuer certificate`) | corp proxy (Zscaler) intercepts HTTPS - point each tool at the corp root CA. See section 0b. |
 | Naming hook rejects a commit | you used snake_case on a DB-mirrored field or a banned acronym - see `CONTRIBUTING.md`. |
 | Plugin toggle throws an internal error | app cannot write `instance/` (the plugin registry lives there) - fix directory permissions. |