Fix bit(1) import coercion and subpath login redirect

The WJ import loader coerced MySQL bit(1) columns with bool(), which is
always true for the bytes pymysql returns; applications.isinstallable
and notifications.isshopfloor imported as 1 for every row. Route both
through the existing _truthy_bit helper. The loader also no longer
requires the employee source database: without it, notifications keep
the bare SSO and the verify stage skips the employee count.

Under a subpath mount, the session-expiry interceptor stored the
browser path (which includes the mount base) as the login redirect,
and the router applied its base again after login. Add stripBase()
and store base-free router paths; the login page also strips a stale
base from old bookmarked redirects.

Also point the external-plugin CI helper at the repo's GitHub URL.

frontend/src/api/index.js

@@ -1,5 +1,5 @@
 import axios from 'axios'
-import { withBase } from './../utils/basePath'
+import { withBase, stripBase } from './../utils/basePath'
 
 // BASE_URL ends in '/', so this is '/api' at root or '/ops/api' under a subpath
 // mount. Keeps the SPA, its API, and IIS all on the same mount path.
@@ -35,8 +35,10 @@ api.interceptors.response.use(
       // Preserve the destination so login returns the user to this page.
       if (hadToken) {
         const loginPath = withBase('/login')
-        const here = window.location.pathname + window.location.search
-        const target = here && here !== loginPath
+        // Router paths exclude the mount base; strip it or login's
+        // router.push double-prefixes under a subpath mount.
+        const here = stripBase(window.location.pathname) + window.location.search
+        const target = here && here !== '/login'
           ? loginPath + '?redirect=' + encodeURIComponent(here)
           : loginPath
         window.location.href = target