Add custom fields + warranty plugin, rework settings into two-pane shell

Feature work from the 2026-07 session:

Settings IA
- Replace the flat 27-card settings hub with a persistent two-pane shell
  (SettingsLayout.vue): grouped, searchable left rail + content pane.
- Nest all settings/* routes under the shell via router post-processing;
  shared nav catalog in settingsNav.js. Group by asset class (PCs, Printers,
  Equipment, Network) so per-type settings stop scattering.

Custom fields (core)
- customfields + customfieldvalues tables (migration 7d14), CRUD API at
  /api/customfields, per-asset value get/save.
- Settings management page + reusable CustomFieldsSection (detail) and
  CustomFieldsInputs (form) wired into all four asset types.

Warranty (new plugin)
- plugins/warranty: warranties + warrantyassets (migration 7d15), derived
  coverage status, provider abstraction (manual now; Dell/Lenovo/HP stubs).
- API CRUD + per-asset panel + report buckets; WarrantyPanel on all four
  detail pages; Warranties management page; Warranty report + Reports card.
- Seed warranty.* permissions.

Printer drivers
- printerdrivers table (migration 7d13) linked to printer models; drivers now
  surface on the matching printer's detail page.

Other
- PCDetail rebalanced (Network + Status + Warranty + custom fields on the right).
- Rename PCs list "Features" column to "Remote Access"; fix badge hover underline.
- Drop equipment islocationonly field.
- Centralize asset-type label/route maps into utils/assetTypes.js.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

shopdb/core/api/auth.py

@@ -1,5 +1,7 @@
 """Authentication API endpoints."""
 
+from datetime import datetime, timedelta
+
 from flask import Blueprint, request
 from flask_jwt_extended import (
     create_access_token,
@@ -16,6 +18,11 @@ from shopdb.utils.responses import success_response, error_response, ErrorCodes
 
 auth_bp = Blueprint('auth', __name__)
 
+# Account lockout policy: after MAX_FAILED_LOGINS consecutive bad passwords,
+# lock the account for LOCKOUT_MINUTES. Mitigates password brute-forcing.
+MAX_FAILED_LOGINS = 5
+LOCKOUT_MINUTES = 15
+
 
 @auth_bp.route('/login', methods=['POST'])
 def login():
@@ -50,20 +57,30 @@ def login():
         isactive=True
     ).first()
 
+    # Reject a locked account before checking the password, so a lockout can't
+    # be probed and a valid password can't reset the clock mid-lockout.
+    if user and user.islocked:
+        return error_response(
+            ErrorCodes.FORBIDDEN,
+            'Account is locked. Try again later or contact an administrator.',
+            http_code=403
+        )
+
     if not user or not check_password_hash(user.passwordhash, data['password']):
+        # Count the failure and lock the account once the threshold is hit.
+        # Only possible when the username matched a real account.
+        if user:
+            user.failedlogins = (user.failedlogins or 0) + 1
+            if user.failedlogins >= MAX_FAILED_LOGINS:
+                user.lockeduntil = datetime.utcnow() + timedelta(minutes=LOCKOUT_MINUTES)
+                user.failedlogins = 0
+            db.session.commit()
         return error_response(
             ErrorCodes.UNAUTHORIZED,
             'Invalid username or password',
             http_code=401
         )
 
-    if user.islocked:
-        return error_response(
-            ErrorCodes.FORBIDDEN,
-            'Account is locked',
-            http_code=403
-        )
-
     # Create tokens (identity must be a string in Flask-JWT-Extended 4.x)
     access_token = create_access_token(
         identity=str(user.userid),
@@ -74,9 +91,10 @@ def login():
     )
     refresh_token = create_refresh_token(identity=str(user.userid))
 
-    # Update last login
+    # Update last login and clear any failed-login state
     user.lastlogindate = db.func.now()
     user.failedlogins = 0
+    user.lockeduntil = None
     db.session.commit()
 
     return success_response({