Add email sending (service + 3 flows) and a general asset label generator

Email: a stdlib SMTP mailer (settings-first config, graceful no-op when
unconfigured), a test-email endpoint wired to the Email settings page,
forced first-login password change (users.mustchangepassword, migration
7d23, /change-password flow), new-user welcome mail, and on-demand
report/alert delivery (POST /api/reports/email + Email Report buttons)
with an external-cron-with-a-scoped-PAT path documented for automation.
All tests patch smtplib - no network.

Labels: a shared /print/asset-label/<type>/<id> view any asset detail
page opens - card or plain style, QR or barcode, configurable encoding.
Per-type qr_target_* templates plus label_default_style/codetype/encodes
settings on the Printing page. Measuring-tool labels default to encoding
their inspection-operation code (derived from the location name, e.g.
0615), so every tool in an area shares the area code - verified by
decoding the rendered QR. Machine labels default to the machine number;
blank-serial handled gracefully.

808 tests pass; both features verified live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

migrations/versions/7d23_user_mustchangepassword.py

@@ -0,0 +1,50 @@
+"""User forced-password-change flag (users.mustchangepassword)
+
+Adds a boolean users.mustchangepassword column (default false). An admin who
+creates a user sets it true so the user is forced through a password change on
+first login; changing the password clears it.
+
+Idempotent guard so it is safe on a partially-migrated box; real downgrade.
+
+Revision ID: 7d23_user_mustchangepassword
+Revises: 7d22_apitokens_scopes
+Create Date: 2026-07-12
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '7d23_user_mustchangepassword'
+down_revision = '7d22_apitokens_scopes'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+
+    if 'users' not in insp.get_table_names():
+        return
+    columns = {c['name'] for c in insp.get_columns('users')}
+    if 'mustchangepassword' in columns:
+        return
+
+    op.add_column(
+        'users',
+        sa.Column('mustchangepassword', sa.Boolean(),
+                  nullable=False, server_default=sa.false()))
+
+
+def downgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+
+    if 'users' not in insp.get_table_names():
+        return
+    columns = {c['name'] for c in insp.get_columns('users')}
+    if 'mustchangepassword' not in columns:
+        return
+
+    op.drop_column('users', 'mustchangepassword')