Phase 4: Warehouse screen, pull table, shorts, MTRs and the upload pipeline

The Warehouse home with the numbers, the Open shorts table, the find bar and the five-column task board
(waiting, being pulled, on hold, pulled, released in the last 3 days) with buttons, hold reasons and drag.
Every role sees the warehouse stage on a packet as the WH pill and the line under it. The pull table on the
Materials tab: Pulled with auto-start, issued, location, heat with Enter to the next line, shorts with
receipts, N/A, MTR per line with a viewer. Send back to Clerical with a reason. Release to supervisor stays
blocked until every line is pulled or short and every pulled line has a heat.

Server: the heats_recorded precondition on WH_RELEASE, receive by custody, server-validated hold and short
reasons, the old packet history texts, GET /api/warehouse/board, cards with the warehouse stage and pull
counts. Uploads typed by content per kind (drawing, mtr, document, bom with XLSX and CSV), limits per kind,
optional ClamAV behind the clamav compose profile, a storage quota alert on the new notification_events
table (migration 0005) shown on the Admin Storage tab.

Tests: every warehouse action as every role, the release gate, the short-receive exception, the heat
pattern, upload sniffing and limits, the ClamAV path with a fake scanner, the quota alert; frontend board
and pull table tests; Playwright scenarios for the board and the pull flow. Verified on docker-1 in the CI
stack: 3557 server tests, 106 frontend tests, 17 Playwright scenarios. Docs updated; D5 closed.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

deploy/compose.yaml

@@ -10,6 +10,9 @@
 #
 # No service publishes a port. NPM reaches the app over npm_default (compose.proxy.yaml).
 # PostgreSQL is only on the internal backend network.
+#
+# ClamAV is optional. Set CLAMAV_HOST=packetstation-clamav in the env file and add `--profile clamav`
+# to every `docker compose` command of that stack. Without the profile the clamav service does not run.
 
 # The project name comes from the env file so prod and test can never share volumes by accident.
 # `docker compose -p` still wins when given.
@@ -164,6 +167,33 @@ services:
     restart: unless-stopped
     logging: *logging
 
+  clamav:
+    # Optional virus scanner for uploads (profile clamav). clamd listens on 3310 on the backend network.
+    # Pinned to the 1.4 minor tag, not a digest: the tag follows the 1.4 patch releases.
+    # To pin a digest: docker buildx imagetools inspect clamav/clamav:1.4 and use the top-level "Digest:".
+    image: clamav/clamav:1.4
+    profiles: ["clamav"]
+    environment:
+      CLAMAV_NO_MILTERD: "true"
+    volumes:
+      - clamav-db:/var/lib/clamav          # Signatures. The first start downloads them (a few minutes).
+    networks:
+      backend:
+        aliases:
+          - packetstation-clamav           # CLAMAV_HOST. Unique so it cannot collide with another stack.
+      egress: {}                           # freshclam needs the internet for signature updates.
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD", "clamdcheck.sh"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 10m                    # Room for the first signature download and load.
+    mem_limit: 2g
+    restart: unless-stopped
+    logging: *logging
+
 networks:
   backend:
     internal: true    # No route out. postgres lives only here.
@@ -173,6 +203,7 @@ networks:
 volumes:
   pgdata: {}
   assets: {}
+  clamav-db: {}
 
 # Host files, root:10001 mode 0440, one value per file, no trailing carriage return.
 secrets: