Fix bit(1) import coercion and subpath login redirect

The WJ import loader coerced MySQL bit(1) columns with bool(), which is
always true for the bytes pymysql returns; applications.isinstallable
and notifications.isshopfloor imported as 1 for every row. Route both
through the existing _truthy_bit helper. The loader also no longer
requires the employee source database: without it, notifications keep
the bare SSO and the verify stage skips the employee count.

Under a subpath mount, the session-expiry interceptor stored the
browser path (which includes the mount base) as the login redirect,
and the router applied its base again after login. Add stripBase()
and store base-free router paths; the login page also strips a stale
base from old bookmarked redirects.

Also point the external-plugin CI helper at the repo's GitHub URL.

frontend/src/api/index.js

@@ -1,5 +1,5 @@
 import axios from 'axios'
-import { withBase } from './../utils/basePath'
+import { withBase, stripBase } from './../utils/basePath'
 
 // BASE_URL ends in '/', so this is '/api' at root or '/ops/api' under a subpath
 // mount. Keeps the SPA, its API, and IIS all on the same mount path.
@@ -35,8 +35,10 @@ api.interceptors.response.use(
       // Preserve the destination so login returns the user to this page.
       if (hadToken) {
         const loginPath = withBase('/login')
-        const here = window.location.pathname + window.location.search
-        const target = here && here !== loginPath
+        // Router paths exclude the mount base; strip it or login's
+        // router.push double-prefixes under a subpath mount.
+        const here = stripBase(window.location.pathname) + window.location.search
+        const target = here && here !== '/login'
           ? loginPath + '?redirect=' + encodeURIComponent(here)
           : loginPath
         window.location.href = target

frontend/src/utils/basePath.js

@@ -11,3 +11,15 @@ export function withBase(path) {
   if (/^([a-z]+:)?\/\//i.test(path) || path.startsWith('data:')) return path
   return BASE_URL + String(path).replace(/^\//, '')
 }
+
+// Inverse of withBase: turn a browser pathname (which includes the mount
+// base, e.g. '/ops/computers') into a router path ('/computers'). Router
+// navigation already applies the base; feeding it an un-stripped pathname
+// double-prefixes ('/ops/ops/...').
+export function stripBase(path) {
+  if (!path) return path
+  if (BASE_URL !== '/' && path.startsWith(BASE_URL)) {
+    return '/' + path.slice(BASE_URL.length)
+  }
+  return path
+}

frontend/src/views/Login.vue

@@ -52,7 +52,7 @@ import { useRouter, useRoute } from 'vue-router'
 import { useAuthStore } from '../stores/auth'
 import { setupApi } from '../api'
 import { getSiteLogo } from '../utils/siteSettings'
-import { withBase } from '../utils/basePath'
+import { withBase, stripBase } from '../utils/basePath'
 
 const router = useRouter()
 const route = useRoute()
@@ -63,7 +63,9 @@ const authStore = useAuthStore()
 function postLoginTarget() {
   const redirect = route.query.redirect
   if (typeof redirect === 'string' && redirect.startsWith('/') && !redirect.startsWith('//')) {
-    return redirect
+    // Tolerate a redirect that still carries the mount base (old bookmarks,
+    // pre-fix interceptor URLs): router paths must be base-free.
+    return stripBase(redirect)
   }
   return '/'
 }

frontend/src/views/geenforce/ManifestEditor.vue

@@ -23,7 +23,7 @@
           <code>common</code> manifest uses PC types to hit a subset; a per-type
           manifest already only runs on its own type, so it shows just the niche
           gate it needs (CMM version, a bay number, a subtype).</p>
-        <p>Full guide: the GE-ENFORCE page in the project wiki.</p>
+        <p>Full guide: <code>the GE-ENFORCE wiki page</code>.</p>
       </div>
     </details>