Reciprocal controls links, dead chip links, and a resumable legacy import

The machine page now shows the PC that controls it. The endpoint was correct all
along and returned both directions; AssetTriageBand discarded every peer whose
type was not 'machine' and was mounted only on the PC page. The counterpart type,
label and relationship types are now props.

Fixed while adopting it more widely: every band chip linked to /assets/<id>, and
there is no such route. The resolver that AssetRelationships.vue kept privately
is now frontend/src/utils/assetRoute.js, used by both - and its type lookup is
case-insensitive, because seed data capitalises the type names while this site's
database does not.

The legacy import is now safe to resume. The 409-resolve asked for
per_page=10000 against a server that clamps to 100, so it silently searched the
first 100 rows and dropped links past that on every re-run. The crosswalk is now
bound to the database it describes, so one carried across a rebuild is refused
rather than attaching rows to the wrong assets. Source database names are
resolved from the environment, so the loader can be aimed without editing it.

Full suite 2178 passed, frontend 280 passed.

scripts/site_imports/wjf/PILOT-DEPLOY.md

@@ -78,9 +78,36 @@ import API. It is site glue, not product code.
      venv/bin/python -m scripts.site_imports.wjf.run
    ```
 
-   The 16 stages run in order (reference -> catalog -> assets hub -> locations ->
-   printers -> dependents -> relationships -> subnets -> usb -> verify). It is
-   idempotent - a crashed run resumes from `idmap.json`.
+   The 17 stages run in order (reference -> employees -> catalog -> assets hub
+   -> locations -> printers -> metrology -> communications -> applications ->
+   warranties -> notifications -> knowledgebase -> relationships ->
+   defaultprinters -> subnets -> usb -> verify).
+
+   **Pointing it at a different source.** The three source databases are
+   named logically in the loader and resolved from the environment, so a
+   restore under another name needs no code edit:
+
+   ```
+   SOURCE_DB_MAIN=prodscratch \
+   SOURCE_DB_USB=cmmc_usb_src \
+   SOURCE_DB_EMPLOYEES=wjf_employees_src \
+   DATABASE_URL=... venv/bin/python -m scripts.site_imports.wjf.run
+   ```
+
+   Also `SOURCE_DB_HOST`, `SOURCE_DB_PORT`, `SOURCE_DB_USER`,
+   `SOURCE_DB_PASSWORD`. The run prints every source it redirected, so
+   "it imported nothing" can be told apart from "it read the wrong database".
+
+   **Resume is per target database.** A crashed run resumes from the crosswalk
+   in `idmap.json`, which maps this site's legacy ids to assetids **in one
+   specific database**. The loader stamps that database's identity into the
+   file and refuses a crosswalk built against a different one, because reusing
+   it attaches warranties and printer assignments to whatever asset now holds
+   that id - wrong data, no error. If you rebuild the target, delete
+   `idmap.json` or pass `--idmap` a fresh path.
+
+   The exit code means something: non-zero if any endpoint errored, so a run
+   that logged 200 failures cannot read as a success in a deploy log.
 
 3. Reclassify servers into network devices. The classic DB stored servers as
    PCs, so the import lands them as `computer` assets. Re-point them in place:
@@ -151,8 +178,12 @@ documented skips (inactive rows, duplicate machinenumbers, LocationOnly, the
 - Keep the classic app authoritative during the window. The pilot is read-mostly
   for validation; do not dual-write.
 - Have a few real users (IT + a floor lead) work the pilot and log gaps.
-- Re-import is cheap: fix a loader mapping, drop + rebuild the pilot DB, re-run.
-  Nothing you do to the pilot touches classic.
+- Re-import is cheap: fix a loader mapping, drop + rebuild the pilot DB,
+  **delete `idmap.json`**, re-run. Nothing you do to the pilot touches classic.
+  The crosswalk is bound to the database it was built against and the loader
+  refuses a stale one, but deleting it is the habit to have - a refusal costs
+  you a restart, and before the guard existed a stale file silently attached
+  rows to the wrong assets.
 - Point the **collector** (GE-Enforce fleet ingest) at the pilot in parallel to
   confirm live PC check-ins land (see `COLLECTOR-INTEGRATION.md`), using a
   scoped service token.
@@ -163,7 +194,7 @@ When the window is clean:
 
 1. Freeze classic writes (announce a short read-only window).
 2. Take final fresh dumps; re-run the loader into a clean pilot DB so the
-   cutover data is current.
+   cutover data is current. A clean DB means a fresh `idmap.json` too.
 3. Verify counts + a fast UI spot-check.
 4. Repoint the production hostname/DNS (or the reverse proxy) at the pilot.
 5. Retire the classic app to read-only standby (do not delete - keep it as the