Printer assignment end to end, and a container that keeps a site's files

Assign printers to a MACHINE and let whichever PC controls it install them, with
the observed half kept strictly apart from the assigned half: a collector report
can never write an assignment row. Adoption is explicit. Adds a singular
relationship type so defaultprinter can mean exactly one, client scripts that
converge a bay's queues and correct a drifted one in place, and a wave gate so a
fleet-wide driver rollout cannot stampede its own share.

On the container side: the compose stack never persisted the instance directory,
so a rebuild discarded plugins.json and every upload. It is a volume now, the
image ships instance/ owned by the app user so the mountpoint is writable, and
the database moves to MySQL 8.4 LTS, which the Windows runbook has recommended
since 8.0 went end of life. The image also could not build at all: the frontend
stage never copied the plugin staging script it runs.

Adds a topology migration guide covering IIS to Docker and back.

docker-compose.airgap.yml

@@ -35,7 +35,7 @@ x-app-env: &app-env
 
 services:
   db:
-    image: mysql:8.0
+    image: mysql:8.4
     command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
     restart: unless-stopped
     environment:
@@ -48,7 +48,12 @@ services:
     ports:
       - "127.0.0.1:${MYSQL_PORT:-3306}:3306"
     healthcheck:
-      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
+      # 127.0.0.1, not localhost: localhost means the unix socket, and the
+      # entrypoint's init pass answers on the socket while running the server
+      # with --skip-networking. A socket ping therefore reports healthy DURING
+      # init, and the api/migrate services start against a server that is about
+      # to restart. Over TCP the probe stays red until the real server listens.
+      test: ["CMD", "mysqladmin", "ping", "-h", "127.0.0.1", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -72,6 +77,11 @@ services:
         flask seed permissions &&
         flask seed settings &&
         flask seed reference-data
+    # plugin upgrade-all rewrites plugins.json, so migrate needs the same
+    # instance volume api uses. Without it the enabled-plugin list is written
+    # into a container that exits immediately afterwards.
+    volumes:
+      - instance_data:/app/instance
 
   api:
     image: shopdb-flask:${IMAGE_TAG:-0.7.0}
@@ -85,6 +95,11 @@ services:
       <<: *app-env
     ports:
       - "${API_PORT:-5001}:5001"
+    # See docker-compose.yml for what lives here. Same reasoning: /app/instance
+    # is written state and does not survive a container recreate on its own.
+    volumes:
+      - instance_data:/app/instance
 
 volumes:
   db_data:
+  instance_data: