Initial import: shopdb-flask multi-site asset platform

Flask + Vue rewrite of the classic-ASP shopdb, built as a plugin
framework so sister GE Aerospace sites can adopt it. Product version
0.7.0-pre-0.8.0, plugin contract 0.11.0, 966 backend tests.

Key entry points:
- docs/INSTALL-WINDOWS-IIS.md - tested Windows + IIS install runbook
  (own-site and subpath deployment methods)
- docs/PILOT-DEPLOY.md - production pilot: stand up + import + verify
- docs/IMPORT-API.md - schema-agnostic legacy data import contract
- scripts/site_imports/wjf/ - West Jefferson reference import loader
- docs/adr/ - twelve accepted architecture decision records

migrations/versions/7d22_apitokens_scopes.py

@@ -0,0 +1,49 @@
+"""API token permission scopes (apitokens.scopes)
+
+Adds a nullable scopes column to apitokens: a JSON array of permission-name
+strings. NULL means the token is unscoped and acts with the full authority of
+its owner (the original behavior). A scoped token grants ONLY the listed
+permissions, intersected with what the owner actually holds, and suspends the
+admin-role bypass so a scoped token minted by an admin is genuinely limited.
+
+Idempotent guard so it is safe on a partially-migrated box; real downgrade.
+
+Revision ID: 7d22_apitokens_scopes
+Revises: 7d21_apitokens
+Create Date: 2026-07-12
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '7d22_apitokens_scopes'
+down_revision = '7d21_apitokens'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+
+    if 'apitokens' not in insp.get_table_names():
+        return
+    columns = {c['name'] for c in insp.get_columns('apitokens')}
+    if 'scopes' in columns:
+        return
+
+    op.add_column('apitokens', sa.Column('scopes', sa.Text(), nullable=True))
+
+
+def downgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+
+    if 'apitokens' not in insp.get_table_names():
+        return
+    columns = {c['name'] for c in insp.get_columns('apitokens')}
+    if 'scopes' not in columns:
+        return
+
+    op.drop_column('apitokens', 'scopes')