Phase 2: core domain, policy engine, packet API, Clerical screen

Migration 0003: projects, aliases, renumbers, units, packets and every child table,
change orders, assets, documents, ITPs, station limits, department weld flag.
Policy package: Principal, PacketState, Action rules, custody, preconditions,
CO hold, order of checks, can/blocked/holder on reads. docs/POLICY.md with the
tightenings table for Seth. Write pipeline: FOR UPDATE, CAS on status and dept,
If-Match row versions, server-assigned numbers, field CAS, version bump, packet
log, audit, NOTIFY, signatures, IT reasons, filed lock and HMAC seal.
API: /api/packets (header, transitions, work orders, pages, docs, move, remove,
BOM, shorts, welds, heat tags, heat table, stage, checklist, clock, warehouse
stage, Q.C., change orders, log, seal), /api/projects, /api/units, /api/assets,
/_blob. Frontend: Clerical home, projects and units, packet page with pdf.js
and QR codes, hand draft, heat map, send to warehouse, department or Q.C.
Tests: policy matrix, API, concurrency, schema, projects; Playwright Clerical
draft scenario. Verified on docker-1 with the CI stack and the Samba DC.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

server/packetstation/settings.py

@@ -99,6 +99,7 @@ class Settings(BaseSettings):
     device_cookie_days: int = Field(default=365, ge=1)
     pin_min_digits: int = Field(default=6, ge=4)
     pin_max_digits: int = Field(default=12, ge=4)
+    upload_max_bytes: int = Field(default=25 * 1024 * 1024, ge=1024)
 
     @model_validator(mode="before")
     @classmethod
@@ -159,6 +160,13 @@ class Settings(BaseSettings):
             raise SecretFileError(f"SESSION_KEY_FILE file {self.session_key_file} holds a key that is too short")
         return key.encode("utf-8")
 
+    def seal_key(self) -> bytes:
+        """The HMAC key for filing seals, from SEAL_KEY_FILE."""
+        key = read_secret(self.seal_key_file, "SEAL_KEY_FILE").strip()
+        if len(key) < 16:
+            raise SecretFileError(f"SEAL_KEY_FILE file {self.seal_key_file} holds a key that is too short")
+        return key.encode("utf-8")
+
 
 @lru_cache(maxsize=1)
 def get_settings() -> Settings: