Initial import: shopdb-flask multi-site asset platform

Flask + Vue rewrite of the classic-ASP shopdb, built as a plugin
framework so sister GE Aerospace sites can adopt it. Product version
0.7.0-pre-0.8.0, plugin contract 0.11.0, 966 backend tests.

Key entry points:
- docs/INSTALL-WINDOWS-IIS.md - tested Windows + IIS install runbook
  (own-site and subpath deployment methods)
- docs/PILOT-DEPLOY.md - production pilot: stand up + import + verify
- docs/IMPORT-API.md - schema-agnostic legacy data import contract
- scripts/site_imports/wjf/ - West Jefferson reference import loader
- docs/adr/ - twelve accepted architecture decision records

deploy/windows/web.config

@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  IIS site config for shopdb-flask via HttpPlatformHandler.
+
+  IIS launches waitress (a Windows-friendly WSGI server; gunicorn does NOT run
+  on Windows) and forwards requests to it on a private loopback port that IIS
+  assigns via %HTTP_PLATFORM_PORT%. One process serves both /api and the built
+  Vue SPA (frontend/dist), so no separate static site is needed.
+
+  Prerequisites on the box:
+    - HttpPlatformHandler IIS module installed
+      (https://www.iis.net/downloads/microsoft/httpplatformhandler)
+    - URL Rewrite module installed (only for the optional X-Forwarded-For rule)
+    - Python 3.12 + a venv at APP_ROOT\venv with requirements.txt + waitress
+    - Secrets live in APP_ROOT\.env (wsgi.py load_dotenv() reads it). Keep them
+      OUT of this file. Lock .env ACLs to the app pool identity + admins.
+
+  Replace APP_ROOT (C:\shopdb-flask below) with the real deploy path. The IIS
+  site's physical path MUST be APP_ROOT (where wsgi.py lives).
+-->
+<configuration>
+  <system.webServer>
+
+    <handlers>
+      <add name="httpplatformhandler" path="*" verb="*"
+           modules="httpPlatformHandler" resourceType="Unspecified" />
+    </handlers>
+
+    <httpPlatform
+        processPath="C:\shopdb-flask\venv\Scripts\waitress-serve.exe"
+        arguments="--port=%HTTP_PLATFORM_PORT% --host=127.0.0.1 --threads=8 wsgi:app"
+        stdoutLogEnabled="true"
+        stdoutLogFile="C:\shopdb-flask\logs\httpplatform"
+        startupTimeLimit="120"
+        startupRetryCount="3">
+      <environmentVariables>
+        <!-- FLASK_ENV MUST be production here or wsgi.py defaults to the dev
+             config (SQL echo, debug, wrong DB URL). Real secrets go in .env. -->
+        <environmentVariable name="FLASK_ENV" value="production" />
+        <environmentVariable name="PYTHONPATH" value="C:\shopdb-flask" />
+        <!-- Subpath method only: when this web.config sits in an IIS
+             Application (e.g. /ops) under an existing site instead of its own
+             site, tell the app its mount path. Must match the alias the
+             Application was created with AND the VITE_BASE_PATH the frontend
+             was built with ('/ops/'). Omit for the own-site method.
+        <environmentVariable name="MOUNT_PATH" value="/ops" />
+        -->
+      </environmentVariables>
+    </httpPlatform>
+
+    <!--
+      OPTIONAL: forward the real client IP so audit logs and the kiosk
+      visitor-location feature (IP -> business unit) see the caller, not the
+      loopback that HttpPlatformHandler connects from.
+
+      This block is COMMENTED OUT by default because it needs the URL Rewrite
+      module; with it uncommented but URL Rewrite not installed, IIS returns
+      HTTP 500.19 ("configuration section not well-formed / cannot be read").
+      Install URL Rewrite (https://www.iis.net/downloads/microsoft/url-rewrite)
+      and then uncomment the <rewrite> block below to enable it.
+
+    <rewrite>
+      <allowedServerVariables>
+        <add name="HTTP_X_FORWARDED_FOR" />
+      </allowedServerVariables>
+      <rules>
+        <rule name="Set X-Forwarded-For" stopProcessing="false">
+          <match url=".*" />
+          <serverVariables>
+            <set name="HTTP_X_FORWARDED_FOR" value="{REMOTE_ADDR}" />
+          </serverVariables>
+          <action type="None" />
+        </rule>
+      </rules>
+    </rewrite>
+    -->
+
+  </system.webServer>
+</configuration>