Multi-site distribution readiness: settings-driven site config, security closeout, release engineering, v0.5.0

Make the app distributable to other GE Aerospace sites (one self-hosted
instance per site, ADR-004). GE values remain the shipped defaults; every
site-specific behavior is now a Setting an admin can change in the UI.

Settings-driven site config:
- Branding: site/QR/badge logos, favicon, primary color (upload endpoints
  mirror the map-blueprint pattern; new Settings > Branding section).
- ServiceNow: search/incident/change URL templates ({ticket}), ticket
  prefixes, enable toggle. Defaults point at the current
  geaerospaceqa.service-now.com global search. Disabled = plain-text tickets.
- Employee-id regex (employeeid_pattern), printer hostname template,
  QR label targets (qr_target_printer / qr_target_usb, blank = asset page,
  else URL template with placeholders), usb_label_style (barcode|qr).
- West Jefferson floor-plan PNGs removed from the tree; generic placeholder
  ships as the map default and sites upload their own blueprint.

Security closeout:
- dashboarddefaults writes now require admin.
- Collector: generic error messages (no str(exc) leak); API key accepted
  via X-API-Key header only (BREAKING: querystring api_key removed).
- IP-based login rate limiting (AUTH_RATELIMIT_* knobs) atop account lockout.
- Setting.set() creation race fixed (IntegrityError retry).

Release engineering and docs:
- __version__ 0.5.0 (distinct from __contract_version__, ADR-007),
  CHANGELOG.md, Gitea Actions CI config, frontend version aligned.
- One wizard-first install story across README/DEPLOY; new CONFIG.md,
  UPGRADE.md, BACKUP-RESTORE.md; CLAUDE.md and ROADMAP de-staled.
- Dockerfile multi-stage build now bundles the frontend; compose binds
  MySQL to 127.0.0.1; stale database/schema.sql and one-off SQL removed.

Debt and fixes:
- .query.get() -> db.session.get() sweep; datetime.utcnow() removed
  (naive-UTC via timezone-aware now); users.py on authz decorators.
- Fixed 4 stale tests (slides feed shape, shopfloor splitperemployee,
  plugin contract purity) and the USB label page field mapping (both usb
  modes emit the cmmc shape: device_id/device_desc).
- Health endpoint reports the real version.

248 tests pass; naming/style check green; frontend builds; fresh-DB
flask db upgrade + seeds verified; QR targets verified by decoding
rendered codes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plugins/usb/api/selfhosted.py

@@ -16,7 +16,7 @@ History rows are synthesized from usbcheckouts (each row = a check-out event and
 if returned, a check-in event).
 """
 
-from datetime import datetime
+from datetime import datetime, timezone
 
 from shopdb.api import (
     db, success_response, error_response, ErrorCodes,
@@ -36,7 +36,7 @@ def _resolve_name(sso):
     try:
         from plugins.employees.models import DirectoryEmployee
         if sso and str(sso).isdigit():
-            emp = DirectoryEmployee.query.get(int(sso))
+            emp = db.session.get(DirectoryEmployee, int(sso))
             if emp:
                 return f'{emp.firstname} {emp.lastname}'.strip()
     except Exception:
@@ -188,7 +188,7 @@ def checkout_device(device_id, data):
     if device.ischeckedout:
         return error_response(ErrorCodes.CONFLICT, 'Device is already checked out', http_code=409)
     name = _resolve_name(badge)
-    now = datetime.utcnow()
+    now = datetime.now(timezone.utc).replace(tzinfo=None)
     db.session.add(USBCheckout(usbdeviceid=device.usbdeviceid, machineid=0, sso=badge,
                                checkoutname=name, checkouttime=now,
                                checkoutreason=data.get('reason')))
@@ -215,7 +215,7 @@ def checkin_device(device_id, data):
                      .filter_by(usbdeviceid=device.usbdeviceid, checkintime=None)
                      .order_by(USBCheckout.checkouttime.desc()).first())
     if open_checkout:
-        open_checkout.checkintime = datetime.utcnow()
+        open_checkout.checkintime = datetime.now(timezone.utc).replace(tzinfo=None)
         open_checkout.waswiped = bool(data.get('sanitized'))
         open_checkout.checkinnotes = data.get('notes')
     device.ischeckedout = False