Add email sending (service + 3 flows) and a general asset label generator

Email: a stdlib SMTP mailer (settings-first config, graceful no-op when
unconfigured), a test-email endpoint wired to the Email settings page,
forced first-login password change (users.mustchangepassword, migration
7d23, /change-password flow), new-user welcome mail, and on-demand
report/alert delivery (POST /api/reports/email + Email Report buttons)
with an external-cron-with-a-scoped-PAT path documented for automation.
All tests patch smtplib - no network.

Labels: a shared /print/asset-label/<type>/<id> view any asset detail
page opens - card or plain style, QR or barcode, configurable encoding.
Per-type qr_target_* templates plus label_default_style/codetype/encodes
settings on the Printing page. Measuring-tool labels default to encoding
their inspection-operation code (derived from the location name, e.g.
0615), so every tool in an area shares the area code - verified by
decoding the rendered QR. Machine labels default to the machine number;
blank-serial handled gracefully.

808 tests pass; both features verified live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shopdb/core/models/__init__.py

@@ -7,7 +7,7 @@ from .vendor import Vendor
 from .model import Model
 from .businessunit import BusinessUnit
 from .dashboarddefault import DashboardDefault
-from .location import Location, LocationType
+from .location import Location, LocationType, derive_locationcode
 from .operatingsystem import OperatingSystem
 from .relationship import AssetRelationship, RelationshipType, RelationshipTypePropagation
 from .communication import Communication, CommunicationType
@@ -37,6 +37,7 @@ __all__ = [
     'DashboardDefault',
     'Location',
     'LocationType',
+    'derive_locationcode',
     'OperatingSystem',
     # Relationships
     'AssetRelationship',

shopdb/core/models/asset.py

@@ -251,6 +251,12 @@ class Asset(BaseModel, SoftDeleteMixin, AuditMixin):
                 if result.get('mapy') is None:
                     result['mapy'] = inherited['mapy']
 
+        # Operation/short code of the resolved location (own or inherited).
+        # Derived from the location name's leading token; labels can encode a
+        # tool's inspection operation instead of the tool. None when unplaced.
+        from .location import derive_locationcode
+        result['locationcode'] = derive_locationcode(result.get('locationname'))
+
         # Include extension data if requested
         if include_type_data:
             ext_data = self._get_extension_data()

shopdb/core/models/location.py

@@ -4,6 +4,21 @@ from shopdb.extensions import db
 from .base import BaseModel
 
 
+def derive_locationcode(locationname):
+    """Operation/short code for a location = leading token of its name.
+
+    Locations have no dedicated code column, so the operation code is the
+    leading whitespace-delimited token of the location name. Example:
+    '0615 Blisk Inspection' -> '0615'. Blank/None name -> None. Used by
+    printed labels that encode a tool's inspection operation rather than the
+    tool itself.
+    """
+    if not locationname:
+        return None
+    parts = str(locationname).strip().split()
+    return parts[0] if parts else None
+
+
 class LocationType(BaseModel):
     """Location classification (ADR-001 shared reference data).
 
@@ -60,10 +75,16 @@ class Location(BaseModel):
     locationtype = db.relationship('LocationType')
     parent = db.relationship('Location', remote_side=[locationid])
 
+    @property
+    def locationcode(self):
+        """Derived operation/short code (leading token of the name)."""
+        return derive_locationcode(self.locationname)
+
     def to_dict(self):
         data = super().to_dict()
         data['locationtypename'] = self.locationtype.locationtype if self.locationtype else None
         data['parentlocationname'] = self.parent.locationname if self.parent else None
+        data['locationcode'] = self.locationcode
         return data
 
     def __repr__(self):

shopdb/core/models/user.py

@@ -198,6 +198,9 @@ class User(BaseModel):
     lastlogindate = db.Column(db.DateTime)
     failedlogins = db.Column(db.Integer, default=0)
     lockeduntil = db.Column(db.DateTime)
+    # Forced password change: set true when an admin creates the account, so the
+    # user is steered through a password change before landing in the app.
+    mustchangepassword = db.Column(db.Boolean, default=False, nullable=False)
 
     # Relationships
     roles = db.relationship(