Build Seth's changes C1 to C11 (Gitea issues 1, 8, 18, 23, 24, 25, 27, 31, 32, 33, 36)

- C1 (issue 1): over target follows VISUAL ticket hours, not the timer.
- C2 (issue 24): a Q.C. reject always needs a reason; accept needs an NCR number after a reject without one.
- C3 (issue 25): an incomplete unit ITP blocks filing.
- C4 (issue 27): prints open the print dialog on the page, no new tab.
- C5 (issue 31): filing is blocked while VISUAL shows a work order open; the feed sets vclosed on VISUAL packets.
- C6 (issue 8): the data book leaves out the history pages.
- C7 (issue 18): the supervisor approves each received short; accept and filing wait for it.
- C8 (issue 23): per-department checklists, edited by the department supervisor or Admin, frozen at START.
- C9 (issue 32): Q.C. and Clerical may run the stamp check.
- C10 (issue 33): the PM screen and reports are for PS-ProjectMgmt and Admin only.
- C11 (issue 36): the Stall screen lists the packets assigned to the welder, at the supervisor's stall.

Migration 0011. Docs: PLAN (also issue 9 confirmed, issue 4 asked), POLICY, SECURITY, SCHEMA, FEED, README, CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

server/packetstation/api/pm.py

@@ -1,6 +1,7 @@
 """Project Management: the read-only reports, the CSV exports and the production status PDF.
 
-Any signed-in session reads (every role may open every packet, PM included). Nothing here writes a packet; an export
+PS-ProjectMgmt and Admin only (change C10, Gitea issue 33); every other role gets 403 on every endpoint here. No other
+screen calls /api/pm: the find bar and the boards read /api/packets. Nothing here writes a packet; an export
 writes one print_log row and one audit row (`report exported`). Every endpoint takes the find bar's scope: the
 project and unit pick, dept, status, station_id, welder_id, flags, flag, q, and the history period (30, 90, 365 or
 all days; default 90). Mine is ignored here. The reports read PostgreSQL only.
@@ -21,7 +22,15 @@ from .deps import Db, Principal, current_principal, get_db, settings_of
 from .errors import ApiError
 from .packets import FIND
 
-router = APIRouter(prefix="/api/pm", tags=["pm"])
+
+def pm_only(p: Principal = Depends(current_principal)) -> Principal:  # noqa: B008
+    """PS-ProjectMgmt (role `pm`) or Admin. Others get 403."""
+    if not (p.is_admin or "pm" in p.roles):
+        raise ApiError(403, "forbidden", "Project Management only.")
+    return p
+
+
+router = APIRouter(prefix="/api/pm", tags=["pm"], dependencies=[Depends(pm_only)])
 
 PERIOD = Query(pm.DEFAULT_PERIOD, pattern="^(30|90|365|all)$")