Review safe-polish: docs accuracy, dead imports, no-emoji, geenforce robustness

From the full multi-agent review (0 high, 7 medium, 17 low findings). Applies
the mechanical, low-risk items; design/policy findings left for a decision.

Docs accuracy: CLAUDE.md contract 0.10.0 -> 0.11.0 and both stale Alembic head
citations -> 7d24_customfield_searchable / 31 migrations; Dockerfile bundled-
plugin comment fixed (drop nonexistent "equipment", add machines +
measuringtools, count eleven).

Style/naming (LOCKED rules): remove a CSS-escaped pushpin emoji before location
search results (no-emoji policy); rename ManifestEditor shareRoot -> shareroot
(variable mirrors the API field verbatim).

Dead code: remove confirmed-unused imports across ~20 modules (require_role/
require_permission scaffold residue, stray db/Vendor/Model/current_user/Optional/
error_response); drop unused build_scope import + a stale GEENFORCE_API_KEY
docstring clause in geenforce. Migration files left untouched.

Correctness: geenforce ingest robustness - record_enforcement_report now 400s
on a non-dict counts / non-list results instead of 500; _apply_app_link ignores
a non-numeric appid per its docstring instead of 500. Regression tests added.

Backend query.get sweep finished: auth.py refresh -> db.session.get (last one).

910 backend tests pass; pyflakes clean; naming green; frontend build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_plugins/test_geenforce_crud.py

@@ -144,6 +144,17 @@ def test_entry_curated_app_link(client, db, auth_headers):
     assert any(a['appname'] == 'eDNC (tracked)' for a in picker)
 
 
+def test_entry_nonnumeric_appid_ignored(client, db, auth_headers):
+    """A non-numeric appid must be ignored (link stays null), not 500. Matches
+    the _apply_app_link docstring contract."""
+    scopeid = _create_scope(client, auth_headers)
+    created = client.post(f'/api/geenforce/scopes/{scopeid}/entries',
+                          json={'Name': 'x', 'Type': 'MSI', 'appid': 'notanumber'},
+                          headers=auth_headers)
+    assert created.status_code == 201, created.get_json()
+    assert created.get_json()['data']['appid'] is None
+
+
 def test_invalid_entry_type_rejected(client, db, auth_headers):
     scopeid = _create_scope(client, auth_headers)
     resp = client.post(f'/api/geenforce/scopes/{scopeid}/entries',

tests/test_plugins/test_geenforce_reporting.py

@@ -36,6 +36,19 @@ def _token(client, auth_headers, scopes):
     return resp.get_json()['data']['secret']
 
 
+def test_report_malformed_counts_is_400(client, db, app, auth_headers):
+    """A wrong JSON shape (counts as a string, results as a string) must be a
+    clean 400, not a 500 from a later .get()/iteration."""
+    _seed_and_publish(app)
+    secret = _token(client, auth_headers, ['geenforce.report'])
+    for bad in ({'counts': 'nope'}, {'results': 'nope'}):
+        body = {'hostname': 'WJCMM01', 'scopename': 'gea-shopfloor-cmm'}
+        body.update(bad)
+        resp = client.post('/api/geenforce/report', json=body,
+                           headers={'X-API-Key': secret})
+        assert resp.status_code == 400, resp.get_json()
+
+
 def test_report_recorded_and_listed(client, db, app, auth_headers):
     _seed_and_publish(app)
     secret = _token(client, auth_headers, ['geenforce.report'])