Multi-site distribution readiness: settings-driven site config, security closeout, release engineering, v0.5.0

Make the app distributable to other GE Aerospace sites (one self-hosted
instance per site, ADR-004). GE values remain the shipped defaults; every
site-specific behavior is now a Setting an admin can change in the UI.

Settings-driven site config:
- Branding: site/QR/badge logos, favicon, primary color (upload endpoints
  mirror the map-blueprint pattern; new Settings > Branding section).
- ServiceNow: search/incident/change URL templates ({ticket}), ticket
  prefixes, enable toggle. Defaults point at the current
  geaerospaceqa.service-now.com global search. Disabled = plain-text tickets.
- Employee-id regex (employeeid_pattern), printer hostname template,
  QR label targets (qr_target_printer / qr_target_usb, blank = asset page,
  else URL template with placeholders), usb_label_style (barcode|qr).
- West Jefferson floor-plan PNGs removed from the tree; generic placeholder
  ships as the map default and sites upload their own blueprint.

Security closeout:
- dashboarddefaults writes now require admin.
- Collector: generic error messages (no str(exc) leak); API key accepted
  via X-API-Key header only (BREAKING: querystring api_key removed).
- IP-based login rate limiting (AUTH_RATELIMIT_* knobs) atop account lockout.
- Setting.set() creation race fixed (IntegrityError retry).

Release engineering and docs:
- __version__ 0.5.0 (distinct from __contract_version__, ADR-007),
  CHANGELOG.md, Gitea Actions CI config, frontend version aligned.
- One wizard-first install story across README/DEPLOY; new CONFIG.md,
  UPGRADE.md, BACKUP-RESTORE.md; CLAUDE.md and ROADMAP de-staled.
- Dockerfile multi-stage build now bundles the frontend; compose binds
  MySQL to 127.0.0.1; stale database/schema.sql and one-off SQL removed.

Debt and fixes:
- .query.get() -> db.session.get() sweep; datetime.utcnow() removed
  (naive-UTC via timezone-aware now); users.py on authz decorators.
- Fixed 4 stale tests (slides feed shape, shopfloor splitperemployee,
  plugin contract purity) and the USB label page field mapping (both usb
  modes emit the cmmc shape: device_id/device_desc).
- Health endpoint reports the real version.

248 tests pass; naming/style check green; frontend builds; fresh-DB
flask db upgrade + seeds verified; QR targets verified by decoding
rendered codes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shopdb/core/api/auth.py

@@ -1,8 +1,9 @@
 """Authentication API endpoints."""
 
-from datetime import datetime, timedelta
+import time
+from datetime import datetime, timedelta, timezone
 
-from flask import Blueprint, request
+from flask import Blueprint, request, current_app
 from flask_jwt_extended import (
     create_access_token,
     create_refresh_token,
@@ -12,7 +13,7 @@ from flask_jwt_extended import (
 )
 from werkzeug.security import check_password_hash
 
-from shopdb.extensions import db
+from shopdb.extensions import db, cache
 from shopdb.core.models import User
 from shopdb.utils.responses import success_response, error_response, ErrorCodes
 
@@ -24,6 +25,39 @@ MAX_FAILED_LOGINS = 5
 LOCKOUT_MINUTES = 15
 
 
+def _login_ip():
+    """Caller IP for rate limiting, honoring the first X-Forwarded-For hop."""
+    forwarded = request.headers.get('X-Forwarded-For')
+    if forwarded:
+        return forwarded.split(',')[0].strip()
+    return request.remote_addr or 'unknown'
+
+
+def _login_ratelimited():
+    """Fixed-window per-IP login limiter. Returns True when the caller is over
+    budget for the current window.
+
+    Backed by the existing cache extension (no new dependency). Under the
+    default SimpleCache the counter is per-process, so with N gunicorn workers
+    the effective budget is N x AUTH_RATELIMIT_MAX. This is defense in depth
+    layered on top of the per-account lockout (see login()); a shared cache
+    backend (Redis/memcached) tightens it to a true global budget.
+    """
+    if not current_app.config.get('AUTH_RATELIMIT_ENABLED', True):
+        return False
+    window = current_app.config.get('AUTH_RATELIMIT_WINDOW_SECONDS', 300)
+    maxhits = current_app.config.get('AUTH_RATELIMIT_MAX', 30)
+    # Time bucket makes this a fixed window: the key rolls over at each window
+    # boundary, so a per-hit set() cannot turn it into a sliding window.
+    bucket = int(time.time() // window) if window > 0 else 0
+    key = f'loginratelimit:{_login_ip()}:{bucket}'
+    count = cache.get(key) or 0
+    if count >= maxhits:
+        return True
+    cache.set(key, count + 1, timeout=window)
+    return False
+
+
 @auth_bp.route('/login', methods=['POST'])
 def login():
     """
@@ -44,6 +78,13 @@ def login():
             }
         }
     """
+    if _login_ratelimited():
+        return error_response(
+            'RATE_LIMITED',
+            'Too many login attempts. Try again later.',
+            http_code=429
+        )
+
     data = request.get_json()
 
     if not data or not data.get('username') or not data.get('password'):
@@ -72,7 +113,9 @@ def login():
         if user:
             user.failedlogins = (user.failedlogins or 0) + 1
             if user.failedlogins >= MAX_FAILED_LOGINS:
-                user.lockeduntil = datetime.utcnow() + timedelta(minutes=LOCKOUT_MINUTES)
+                # Naive UTC to match the naive lockeduntil column comparisons.
+                user.lockeduntil = datetime.now(timezone.utc).replace(tzinfo=None) \
+                    + timedelta(minutes=LOCKOUT_MINUTES)
                 user.failedlogins = 0
             db.session.commit()
         return error_response(