Phase 4: Warehouse screen, pull table, shorts, MTRs and the upload pipeline

The Warehouse home with the numbers, the Open shorts table, the find bar and the five-column task board
(waiting, being pulled, on hold, pulled, released in the last 3 days) with buttons, hold reasons and drag.
Every role sees the warehouse stage on a packet as the WH pill and the line under it. The pull table on the
Materials tab: Pulled with auto-start, issued, location, heat with Enter to the next line, shorts with
receipts, N/A, MTR per line with a viewer. Send back to Clerical with a reason. Release to supervisor stays
blocked until every line is pulled or short and every pulled line has a heat.

Server: the heats_recorded precondition on WH_RELEASE, receive by custody, server-validated hold and short
reasons, the old packet history texts, GET /api/warehouse/board, cards with the warehouse stage and pull
counts. Uploads typed by content per kind (drawing, mtr, document, bom with XLSX and CSV), limits per kind,
optional ClamAV behind the clamav compose profile, a storage quota alert on the new notification_events
table (migration 0005) shown on the Admin Storage tab.

Tests: every warehouse action as every role, the release gate, the short-receive exception, the heat
pattern, upload sniffing and limits, the ClamAV path with a fake scanner, the quota alert; frontend board
and pull table tests; Playwright scenarios for the board and the pull flow. Verified on docker-1 in the CI
stack: 3557 server tests, 106 frontend tests, 17 Playwright scenarios. Docs updated; D5 closed.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

server/packetstation/migrations/0005_warehouse.sql

@@ -0,0 +1,24 @@
+-- 0005_warehouse: the notification placeholder. Phase 4 writes the storage quota alert here; phase 9 builds the
+-- delivery (mail, the bell) on this table. Runs as ps_migrate; 0001's default privileges give ps_app SELECT,
+-- INSERT, UPDATE, DELETE on it.
+
+-- One row per alert. An alert is open until resolved_at is set. Acknowledging it does not resolve it: the
+-- condition that raised it has to clear.
+CREATE TABLE notification_events (
+    id               bigserial PRIMARY KEY,
+    kind             text NOT NULL,
+    severity         text NOT NULL DEFAULT 'warning' CHECK (severity IN ('info', 'warning', 'critical')),
+    subject          text,
+    detail           jsonb NOT NULL DEFAULT '{}',
+    created_at       timestamptz NOT NULL DEFAULT now(),
+    resolved_at      timestamptz,
+    acknowledged_at  timestamptz,
+    acknowledged_by  uuid REFERENCES users (id)
+);
+
+-- At most one open alert per kind and subject.
+CREATE UNIQUE INDEX notification_events_open ON notification_events (kind, coalesce(subject, ''))
+    WHERE resolved_at IS NULL;
+CREATE INDEX notification_events_created ON notification_events (created_at DESC);
+
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ps_app;