Phase 4: Warehouse screen, pull table, shorts, MTRs and the upload pipeline

The Warehouse home with the numbers, the Open shorts table, the find bar and the five-column task board
(waiting, being pulled, on hold, pulled, released in the last 3 days) with buttons, hold reasons and drag.
Every role sees the warehouse stage on a packet as the WH pill and the line under it. The pull table on the
Materials tab: Pulled with auto-start, issued, location, heat with Enter to the next line, shorts with
receipts, N/A, MTR per line with a viewer. Send back to Clerical with a reason. Release to supervisor stays
blocked until every line is pulled or short and every pulled line has a heat.

Server: the heats_recorded precondition on WH_RELEASE, receive by custody, server-validated hold and short
reasons, the old packet history texts, GET /api/warehouse/board, cards with the warehouse stage and pull
counts. Uploads typed by content per kind (drawing, mtr, document, bom with XLSX and CSV), limits per kind,
optional ClamAV behind the clamav compose profile, a storage quota alert on the new notification_events
table (migration 0005) shown on the Admin Storage tab.

Tests: every warehouse action as every role, the release gate, the short-receive exception, the heat
pattern, upload sniffing and limits, the ClamAV path with a fake scanner, the quota alert; frontend board
and pull table tests; Playwright scenarios for the board and the pull flow. Verified on docker-1 in the CI
stack: 3557 server tests, 106 frontend tests, 17 Playwright scenarios. Docs updated; D5 closed.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

server/packetstation/api/admin.py

@@ -1,4 +1,5 @@
-"""Admin: users and their AD view (read-only), PIN clearing, devices, the group map, AD refresh, attempts.
+"""Admin: users and their AD view (read-only), PIN clearing, devices, the group map, AD refresh, attempts, storage
+and alerts.
 
 Every route needs the admin role and a password session. Roles cannot be changed here: they come from AD.
 """
@@ -21,8 +22,9 @@ from ..auth import groups as groupmap
 from ..auth import pin as pins
 from ..auth.ldap import LdapUnavailable
 from ..auth.signin import ldap_down
+from ..domain import assets, scan
 from .account import active_sessions
-from .deps import Db, Principal, admin_principal, directory_of, get_db
+from .deps import Db, Principal, admin_principal, directory_of, get_db, settings_of
 from .errors import ApiError
 
 router = APIRouter(prefix="/api/admin", tags=["admin"])
@@ -307,3 +309,102 @@ def signin_attempts(
         }
         for r in rows
     ]
+
+
+# ---------------------------------------------------------------- storage and alerts
+
+PING_MAX_SECONDS = 5.0
+ALERT_SELECT = (
+    "SELECT n.*, u.display_name AS acknowledged_name FROM notification_events n"
+    " LEFT JOIN users u ON u.id = n.acknowledged_by"
+)
+
+
+def _alert_row(r: dict[str, Any]) -> dict[str, Any]:
+    by = r.get("acknowledged_by")
+    return {
+        "id": r["id"],
+        "kind": r["kind"],
+        "severity": r["severity"],
+        "subject": r["subject"],
+        "detail": r["detail"] or {},
+        "created_at": r["created_at"],
+        "resolved_at": r["resolved_at"],
+        "acknowledged_at": r["acknowledged_at"],
+        "acknowledged_by": {"id": str(by), "display_name": r.get("acknowledged_name")} if by else None,
+    }
+
+
+@router.get("/storage")
+def storage(
+    request: Request,
+    p: Principal = Depends(admin_principal),  # noqa: B008
+    d: Db = Depends(get_db),  # noqa: B008
+) -> dict[str, Any]:
+    s = settings_of(request)
+    usage = assets.usage_for(d.conn, s)
+    with d.conn.cursor(row_factory=dict_row) as cur:
+        r = cur.execute(
+            ALERT_SELECT + " WHERE n.kind = %s AND coalesce(n.subject, '') = %s AND n.resolved_at IS NULL"
+            " ORDER BY n.id LIMIT 1",
+            (assets.QUOTA_KIND, assets.QUOTA_SUBJECT),
+        ).fetchone()
+    scanner = scan.scanner_for(s)
+    clamav: dict[str, Any] = {"configured": scanner is not None, "host": None, "port": None, "reachable": None}
+    if scanner is not None:
+        clamav.update(
+            host=scanner.host,
+            port=scanner.port,
+            reachable=scanner.ping(timeout=min(scanner.timeout, PING_MAX_SECONDS)),
+        )
+    return {
+        "usage": usage,
+        "quota_warn_pct": int(s.assets_quota_warn_pct),
+        "quota_bytes": int(s.assets_quota_bytes),
+        "alert": _alert_row(dict(r)) if r else None,
+        "clamav": clamav,
+    }
+
+
+@router.get("/alerts")
+def alerts(
+    p: Principal = Depends(admin_principal),  # noqa: B008
+    d: Db = Depends(get_db),  # noqa: B008
+) -> dict[str, Any]:
+    with d.conn.cursor(row_factory=dict_row) as cur:
+        rows = cur.execute(
+            ALERT_SELECT + " WHERE n.resolved_at IS NULL ORDER BY n.created_at DESC, n.id DESC"
+        ).fetchall()
+    return {"alerts": [_alert_row(dict(r)) for r in rows]}
+
+
+@router.post("/alerts/{alert_id}/ack")
+def ack_alert(
+    alert_id: int,
+    p: Principal = Depends(admin_principal),  # noqa: B008
+    d: Db = Depends(get_db),  # noqa: B008
+) -> dict[str, Any]:
+    conn = d.conn
+    with conn.transaction():
+        done = conn.execute(
+            "UPDATE notification_events SET acknowledged_at = now(), acknowledged_by = %s"
+            " WHERE id = %s AND acknowledged_at IS NULL RETURNING kind, subject",
+            (p.user_id, alert_id),
+        ).fetchone()
+        if done is not None:
+            audit.append(
+                conn,
+                action="alert.acknowledged",
+                user_id=p.user_id,
+                session_id=p.session_id,
+                role_snapshot=p.role_snapshot,
+                subject_type="notification",
+                subject_id=str(alert_id),
+                detail={"kind": done[0], "subject": done[1]},
+                ip=p.ip,
+            )
+    with conn.cursor(row_factory=dict_row) as cur:
+        r = cur.execute(ALERT_SELECT + " WHERE n.id = %s", (alert_id,)).fetchone()
+    if r is None:
+        raise ApiError(404, "not_found", "No such alert.")
+    return _alert_row(dict(r))