Document the upload, proof and forecast endpoints

Ten routes shipped over the last few commits without reaching the inventory,
which is the file everything else is generated from - openapi.json, the /api/docs
browser, and the per-site build. An endpoint absent from it is invisible to
anyone integrating against the API even though it answers requests.

The auth notes matter more than the paths. API-REFERENCE tells a deployment
reviewer that essentially every GET is optional-auth; two of these are not, and
an exception buried in a table of 372 operations is one nobody reads. The
installer download and the warranty proof are called out with why: one is
licensed vendor software, the other carries pricing and a service tag. The
application image is listed with the fully public endpoints, since tiles render
before login.

CHANGELOG.md

@@ -12,6 +12,34 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- Applications accept an uploaded image and an uploaded installer, rather than
+  only a path typed into a text box. The path field kept working only while
+  someone maintained a share by hand, and a link to a file nobody could still
+  find was indistinguishable from a link to one that worked. The installer
+  download is gated on `applications.view` because it is licensed vendor
+  software; the image is public, since tiles render before login.
+- Warranty records accept an uploaded proof document - the invoice or
+  certificate that actually settles a claim. The documentation path stays as it
+  was: it points at a vendor portal or a share, which an upload cannot replace.
+  Downloads require `warranty.view`, since a proof carries pricing and a service
+  tag, and it comes back under the vendor's own filename so it is recognisable
+  in a support ticket.
+- Toner forecast report: days until each cartridge runs out, soonest first,
+  from Zabbix level history. Ordering by days left rather than by level is the
+  point - a cartridge at 60% draining fast needs ordering before one sitting at
+  8% that has not moved in a month. It also counts how many cartridges each
+  printer has been through in the window, which is the number a purchasing
+  conversation asks for. Printers with no honest estimate are listed
+  separately with the reason (too little history, gauge has not moved, replaced
+  recently) instead of being sorted in as zero or as safe, and an unreachable
+  Zabbix says so rather than rendering an empty table that reads as "nothing is
+  due".
+- Fiscal week under the site name in the sidebar and on the shop-floor board,
+  as the classic ASP site showed it. People quote a week number across both
+  sites, so the arithmetic is a port of the old one (ISO 8601: week 1 contains
+  4 January, the week's Thursday decides the year) rather than a fresh
+  interpretation.
+
 - Backup history distinguishes CAPTURED from LAST VERIFIED. Captured is when a
   configuration was written; verified is when a PC last posted it and the hash
   still matched. They differ by design, because an unchanged config writes no