Phase 2: core domain, policy engine, packet API, Clerical screen

Migration 0003: projects, aliases, renumbers, units, packets and every child table,
change orders, assets, documents, ITPs, station limits, department weld flag.
Policy package: Principal, PacketState, Action rules, custody, preconditions,
CO hold, order of checks, can/blocked/holder on reads. docs/POLICY.md with the
tightenings table for Seth. Write pipeline: FOR UPDATE, CAS on status and dept,
If-Match row versions, server-assigned numbers, field CAS, version bump, packet
log, audit, NOTIFY, signatures, IT reasons, filed lock and HMAC seal.
API: /api/packets (header, transitions, work orders, pages, docs, move, remove,
BOM, shorts, welds, heat tags, heat table, stage, checklist, clock, warehouse
stage, Q.C., change orders, log, seal), /api/projects, /api/units, /api/assets,
/_blob. Frontend: Clerical home, projects and units, packet page with pdf.js
and QR codes, hand draft, heat map, send to warehouse, department or Q.C.
Tests: policy matrix, API, concurrency, schema, projects; Playwright Clerical
draft scenario. Verified on docker-1 with the CI stack and the Samba DC.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

frontend/src/api/assets.ts

@@ -0,0 +1,19 @@
+// Asset upload and the blob URL. The upload is multipart through the shared request.
+import { api, request } from "./client";
+import type { Asset } from "./types";
+
+/** Same-origin URL of a stored file. */
+export function blobUrl(assetId: string, download = false): string {
+  return `/_blob/${encodeURIComponent(assetId)}${download ? "?download=1" : ""}`;
+}
+
+export const assetsApi = {
+  upload: (file: File, opts: { packet_id?: number; purpose?: string } = {}) => {
+    const fd = new FormData();
+    fd.append("file", file, file.name);
+    if (opts.packet_id !== undefined) fd.append("packet_id", String(opts.packet_id));
+    if (opts.purpose) fd.append("purpose", opts.purpose);
+    return request<Asset>("/api/assets", { method: "POST", body: fd });
+  },
+  get: (id: string, signal?: AbortSignal) => api.get<Asset>(`/api/assets/${encodeURIComponent(id)}`, signal),
+};