Add custom fields + warranty plugin, rework settings into two-pane shell

Feature work from the 2026-07 session:

Settings IA
- Replace the flat 27-card settings hub with a persistent two-pane shell
  (SettingsLayout.vue): grouped, searchable left rail + content pane.
- Nest all settings/* routes under the shell via router post-processing;
  shared nav catalog in settingsNav.js. Group by asset class (PCs, Printers,
  Equipment, Network) so per-type settings stop scattering.

Custom fields (core)
- customfields + customfieldvalues tables (migration 7d14), CRUD API at
  /api/customfields, per-asset value get/save.
- Settings management page + reusable CustomFieldsSection (detail) and
  CustomFieldsInputs (form) wired into all four asset types.

Warranty (new plugin)
- plugins/warranty: warranties + warrantyassets (migration 7d15), derived
  coverage status, provider abstraction (manual now; Dell/Lenovo/HP stubs).
- API CRUD + per-asset panel + report buckets; WarrantyPanel on all four
  detail pages; Warranties management page; Warranty report + Reports card.
- Seed warranty.* permissions.

Printer drivers
- printerdrivers table (migration 7d13) linked to printer models; drivers now
  surface on the matching printer's detail page.

Other
- PCDetail rebalanced (Network + Status + Warranty + custom fields on the right).
- Rename PCs list "Features" column to "Remote Access"; fix badge hover underline.
- Drop equipment islocationonly field.
- Centralize asset-type label/route maps into utils/assetTypes.js.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

shopdb/utils/authz.py

@@ -0,0 +1,74 @@
+"""Authorization decorators for role and permission gating.
+
+Authentication (is the caller logged in?) is handled by Flask-JWT-Extended's
+@jwt_required. Authorization (is the caller ALLOWED to do this?) is handled
+here. The two are separate concerns; a route needs both on any state-changing
+action.
+
+These decorators call verify_jwt_in_request() themselves, so they work whether
+or not a separate @jwt_required is also present. The admin role bypasses every
+permission check (see User.haspermission), so an admin never needs individual
+permissions granted.
+
+Usage:
+
+    @assets_bp.route('/<int:asset_id>', methods=['DELETE'])
+    @jwt_required()
+    @require_permission('assets.delete')
+    def delete_asset(asset_id):
+        ...
+"""
+
+from functools import wraps
+
+from flask_jwt_extended import verify_jwt_in_request, current_user
+
+from shopdb.utils.responses import error_response, ErrorCodes
+
+
+def require_permission(permission_name: str):
+    """Gate a route behind a single permission. Admin role bypasses."""
+    def decorator(view_func):
+        @wraps(view_func)
+        def wrapper(*args, **kwargs):
+            # verify jwt first so current_user is loaded (idempotent if the
+            # route also has @jwt_required)
+            verify_jwt_in_request()
+            if current_user is None:
+                return error_response(
+                    ErrorCodes.UNAUTHORIZED,
+                    'Authentication required',
+                    http_code=401
+                )
+            if not current_user.haspermission(permission_name):
+                return error_response(
+                    ErrorCodes.FORBIDDEN,
+                    'You do not have permission to perform this action',
+                    http_code=403
+                )
+            return view_func(*args, **kwargs)
+        return wrapper
+    return decorator
+
+
+def require_role(rolename: str):
+    """Gate a route behind a single role (e.g. 'admin')."""
+    def decorator(view_func):
+        @wraps(view_func)
+        def wrapper(*args, **kwargs):
+            verify_jwt_in_request()
+            if current_user is None:
+                return error_response(
+                    ErrorCodes.UNAUTHORIZED,
+                    'Authentication required',
+                    http_code=401
+                )
+            if not current_user.hasrole(rolename):
+                return error_response(
+                    ErrorCodes.FORBIDDEN,
+                    f'{rolename.capitalize()} access required',
+                    http_code=403
+                )
+            return view_func(*args, **kwargs)
+        return wrapper
+    return decorator

shopdb/utils/cmmc_usb_db.py

@@ -0,0 +1,22 @@
+"""Connection helper for the CMMC USB check-in/out database.
+
+Credentials are pulled from app config (env-backed, see Config.CMMC_USB_DB_*),
+never hardcoded. Used by the USB plugin to track device check-in/out against a
+separate MySQL database (cmmc_usb), mirroring the read-only employee-directory
+pattern in employee_db.py. Unlike the employee DB this one is read-write, so
+callers commit their own writes and close the connection in a finally block.
+"""
+
+import pymysql
+from flask import current_app
+
+
+def cmmc_usb_connection():
+    """Open a pymysql connection to the cmmc_usb DB."""
+    return pymysql.connect(
+        host=current_app.config['CMMC_USB_DB_HOST'],
+        user=current_app.config['CMMC_USB_DB_USER'],
+        password=current_app.config['CMMC_USB_DB_PASSWORD'],
+        database=current_app.config['CMMC_USB_DB_NAME'],
+        cursorclass=pymysql.cursors.DictCursor,
+    )