Build Seth's changes C1 to C11 (Gitea issues 1, 8, 18, 23, 24, 25, 27, 31, 32, 33, 36)

- C1 (issue 1): over target follows VISUAL ticket hours, not the timer.
- C2 (issue 24): a Q.C. reject always needs a reason; accept needs an NCR number after a reject without one.
- C3 (issue 25): an incomplete unit ITP blocks filing.
- C4 (issue 27): prints open the print dialog on the page, no new tab.
- C5 (issue 31): filing is blocked while VISUAL shows a work order open; the feed sets vclosed on VISUAL packets.
- C6 (issue 8): the data book leaves out the history pages.
- C7 (issue 18): the supervisor approves each received short; accept and filing wait for it.
- C8 (issue 23): per-department checklists, edited by the department supervisor or Admin, frozen at START.
- C9 (issue 32): Q.C. and Clerical may run the stamp check.
- C10 (issue 33): the PM screen and reports are for PS-ProjectMgmt and Admin only.
- C11 (issue 36): the Stall screen lists the packets assigned to the welder, at the supervisor's stall.

Migration 0011. Docs: PLAN (also issue 9 confirmed, issue 4 asked), POLICY, SECURITY, SCHEMA, FEED, README, CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

frontend/src/lib/toolAccess.ts

@@ -0,0 +1,29 @@
+// Who sees the screens outside the role switcher, and the PM screen. The server decides on every request; this only
+// hides what cannot work.
+import { orderScreens, parseRole, type Screen } from "../auth/roles";
+
+/** The Project Management screen: PS-ProjectMgmt and Admin only (change C10). */
+export function canPm(roles: readonly string[]): boolean {
+  return roles.some((r) => r === "pm" || r === "admin");
+}
+
+/** The stamp check: Admin, Q.C. and every Clerical level (change C9). */
+export function canStampCheck(roles: readonly string[]): boolean {
+  return roles.some((r) => r === "admin" || r === "qc" || r.startsWith("qc_") || r === "clerical" || r.startsWith("clerical_"));
+}
+
+/** The department checklists: a department supervisor (a lead is not enough) or Admin (change C8). */
+export function canChecklists(roles: readonly string[]): boolean {
+  return roles.some((r) => {
+    if (r === "admin") return true;
+    const p = parseRole(r);
+    return p.shop && p.level === "supervisor";
+  });
+}
+
+export const PM_WHO = "It is for Project Management and Admin.";
+
+/** The screens the shell offers: the session's list, with PM only for PS-ProjectMgmt and Admin (change C10). */
+export function shellScreens(screens: readonly string[], roles: readonly string[]): Screen[] {
+  return orderScreens(screens).filter((s) => s !== "pm" || canPm(roles));
+}