Review safe-polish: docs accuracy, dead imports, no-emoji, geenforce robustness

From the full multi-agent review (0 high, 7 medium, 17 low findings). Applies
the mechanical, low-risk items; design/policy findings left for a decision.

Docs accuracy: CLAUDE.md contract 0.10.0 -> 0.11.0 and both stale Alembic head
citations -> 7d24_customfield_searchable / 31 migrations; Dockerfile bundled-
plugin comment fixed (drop nonexistent "equipment", add machines +
measuringtools, count eleven).

Style/naming (LOCKED rules): remove a CSS-escaped pushpin emoji before location
search results (no-emoji policy); rename ManifestEditor shareRoot -> shareroot
(variable mirrors the API field verbatim).

Dead code: remove confirmed-unused imports across ~20 modules (require_role/
require_permission scaffold residue, stray db/Vendor/Model/current_user/Optional/
error_response); drop unused build_scope import + a stale GEENFORCE_API_KEY
docstring clause in geenforce. Migration files left untouched.

Correctness: geenforce ingest robustness - record_enforcement_report now 400s
on a non-dict counts / non-list results instead of 500; _apply_app_link ignores
a non-numeric appid per its docstring instead of 500. Regression tests added.

Backend query.get sweep finished: auth.py refresh -> db.session.get (last one).

910 backend tests pass; pyflakes clean; naming green; frontend build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/geenforce/service.py

@@ -127,6 +127,12 @@ def record_enforcement_report(payload):
     phase = (payload.get('phase') or 'runtime').strip()
     counts = payload.get('counts') or {}
     results = payload.get('results') or []
+    # Guard wrong JSON shapes: a bad type must be a clean 400, not a 500 from a
+    # later .get()/iteration (the route maps ValueError to 400).
+    if not isinstance(counts, dict):
+        raise ValueError('counts must be an object')
+    if not isinstance(results, list):
+        raise ValueError('results must be a list')
 
     failed = int(counts.get('failed', 0))
     installed = int(counts.get('installed', 0))