fix(installer): stop it lying, stop it leaking, and make it findable

Nine fixes from a review of the installer against its actual audience: DT leads
at sister sites who are not Windows, IIS or Python specialists and who will lean
on an AI assistant to get through it.

TRUTHFULNESS. The preflight was advisory - an operator read 'IIS is not
installed', pressed Next, answered five more pages and the install died partway
through with Python already on the box. The results page now blocks while
anything is failing, repaints on every run instead of latching after the first,
and offers 'Check again' so a fixed problem does not mean starting over. On
failure the wizard said 'Nothing was left running', which is false in every path
because the stages run with -OnFailure never: it now says the server is
part-configured, that re-running is safe, and how to remove it. The final page no
longer reads 'ShopDB-Flask is ready' after a failed install.

SECRETS. The generated MySQL root password went to Write-Host in a process the
wizard runs hidden - so nobody saw it - and stdout is forwarded into the setup
log operators are told to send to support, so it was permanently recorded for
everyone who did not need it. It now goes to an ACL'd file. Database dumps, which
contain every user password hash, landed in a ProgramData directory readable by
every user on the box; the directory is now locked at creation.

UPGRADES ON REMOTE-DATABASE SITES. mysqldump was looked for only under local
MySQL install paths, so a site whose database is on another host silently skipped
every pre-upgrade backup - after stage 2 had already stopped the pool and
replaced the tree. Find-MysqlTool now prefers a client shipped in the bundle,
stage 2 stages it onto the server, preflight reports when it is missing, and
mysqlclient\ is an optional locked payload.

UNINSTALL. A subpath install is an IIS Application, not a site; removing only the
site left the application pointing at a deleted directory, so the parent site -
at West Jefferson, the live classic ASP - served 503 on that path forever while
Add/Remove Programs reported success. Uninstall now reads MOUNT_PATH and removes
the application. The firewall rule was created as "$SiteName $SitePort" and
removed as the literal 'ShopDB-Flask 8090', which matches nothing.

DAY-2 TOOLING. Every shortcut now passes -AppRoot and -SitePort, and the console
forwards them through its own elevation and 32-bit relaunches instead of
discarding them - a non-default directory or port made it report a healthy site
as broken, from a shortcut the installer wrote. 'Open ShopDB-Flask' resolved to a
hardcoded localhost:8090 that was wrong for every subpath install; it now asks
the console, which reads the address the installer recorded, and no longer
demands administrator to open a browser.

SMOKE TEST. The parent-site port lookup filtered for an http binding and
defaulted to 80, so an https-only parent site failed a working install with a red
dialog.

DOCS AND /api/docs. The installer was invisible: nothing in docs/, README.md or
CLAUDE.md mentioned it, so a DT lead or their assistant landed on the manual IIS
runbook and hand-built the very server the installer then refuses to upgrade.
docs/INSTALL-WINDOWS.md and docs/OPERATE-WINDOWS.md are now the canonical route,
the two manual runbooks are bannered as reference-only, README and CLAUDE.md
route by target, and llms.txt tells an assistant which document to follow and to
ask for 'check -Json' before diagnosing. Both ship on the server, along with
openapi.json and llms.txt - without those the self-hosted /api/docs was broken on
every installed box, which matters most to the sites least able to debug it.
Stage 5 now checks it actually serves.

shopdb-admin.ps1 gains 'check -Json': one structured, secret-free block covering
version, publishing method, IIS state, HTTP reachability, database, Python
version, plugins and errors. That is the cheapest useful answer to 'the operator
will ask an LLM' - it works with no infrastructure, which a install-time MCP
server could not.

docs/llms.txt

@@ -5,6 +5,29 @@ network devices, measuring tools, applications, knowledge base, USB, warranties)
 for GE Aerospace sites. This file is the quick entrypoint; the full machine
 spec is the OpenAPI at `/api/docs/openapi.json` (browse it at `/api/docs`).
 
+## Installing and operating this server (read this before answering "how do I install/fix it")
+The people running these servers are often not Windows, IIS or Python
+specialists, and they ask assistants for help. Two documents are authoritative:
+- `docs/INSTALL-WINDOWS.md` - installing a NEW site. One offline installer `.exe`.
+- `docs/OPERATE-WINDOWS.md` - restart, logs, backups, upgrades, troubleshooting.
+Both ship in `docs/` inside the install directory on every installed server.
+
+Do NOT walk someone through `docs/INSTALL-WINDOWS-IIS.md` or
+`docs/DEPLOY-WINDOWS-IIS.md` for a new site. Those are the MANUAL procedure, kept
+only for hand-built servers that predate the installer; following them produces a
+server the installer then refuses to upgrade.
+
+Day-2 operations all go through `shopdb-admin.ps1` in the install directory
+(default `C:\shopdb-flask`): `status`, `restart`, `logs`, `check`, `verify`,
+`backup`, `plugins`, `open`. Before diagnosing anything, ask for the output of
+`shopdb-admin.ps1 check -Json` - it reports version, publishing method, IIS and
+pool state, HTTP reachability, database host and reachability, Python version,
+installed plugins and errors, and it contains no secrets. `verify -Path <name>`
+answers "does this server carry component X" from the on-box CycloneDX SBOM.
+
+Python is 3.14 and the wheelhouse is locked to it; an upgrade against a venv
+built by a different minor version is refused by design.
+
 ## Base URL
 Prod (West Jefferson): `https://tsgwp00525.wjs.geaerospace.net/shopdb`
 All API paths are under `/api` (e.g. `<base>/api/assets`). Dev: `http://localhost:5001`.