Build Seth's changes C1 to C11 (Gitea issues 1, 8, 18, 23, 24, 25, 27, 31, 32, 33, 36)

- C1 (issue 1): over target follows VISUAL ticket hours, not the timer.
- C2 (issue 24): a Q.C. reject always needs a reason; accept needs an NCR number after a reject without one.
- C3 (issue 25): an incomplete unit ITP blocks filing.
- C4 (issue 27): prints open the print dialog on the page, no new tab.
- C5 (issue 31): filing is blocked while VISUAL shows a work order open; the feed sets vclosed on VISUAL packets.
- C6 (issue 8): the data book leaves out the history pages.
- C7 (issue 18): the supervisor approves each received short; accept and filing wait for it.
- C8 (issue 23): per-department checklists, edited by the department supervisor or Admin, frozen at START.
- C9 (issue 32): Q.C. and Clerical may run the stamp check.
- C10 (issue 33): the PM screen and reports are for PS-ProjectMgmt and Admin only.
- C11 (issue 36): the Stall screen lists the packets assigned to the welder, at the supervisor's stall.

Migration 0011. Docs: PLAN (also issue 9 confirmed, issue 4 asked), POLICY, SECURITY, SCHEMA, FEED, README, CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

server/packetstation/migrations/0011_seth_changes.sql

@@ -0,0 +1,47 @@
+-- 0011: schema for Seth's changes of 2026-10-26 and 2026-10-28 (docs/PLAN.md, changes C7 and C8). Runs as ps_migrate.
+
+-- ---------------------------------------------------------------- C7: supervisor approval of received shorts
+
+-- Gitea issue 18. The warehouse records a receipt (short_receipts); the department supervisor then approves that
+-- receipt, checking the part and its heat number against what the warehouse issued. One approval per receipt.
+-- A packet cannot be accepted as complete while a short is open or a receipt has no approval.
+CREATE TABLE short_approvals (
+    id           bigserial PRIMARY KEY,
+    receipt_id   bigint NOT NULL UNIQUE REFERENCES short_receipts (id),
+    short_id     bigint NOT NULL REFERENCES bom_shorts (id),
+    packet_id    bigint NOT NULL REFERENCES packets (id),
+    -- the department the packet was in when the supervisor approved
+    dept_code    text NOT NULL REFERENCES departments (code),
+    note         text,
+    signature_id bigint REFERENCES signatures (id),
+    at           timestamptz NOT NULL DEFAULT now(),
+    by           uuid NOT NULL REFERENCES users (id)
+);
+CREATE INDEX short_approvals_packet ON short_approvals (packet_id);
+
+CREATE TRIGGER short_approvals_append_only
+    BEFORE UPDATE OR DELETE ON short_approvals
+    FOR EACH ROW EXECUTE FUNCTION ps_append_only();
+CREATE TRIGGER short_approvals_no_truncate
+    BEFORE TRUNCATE ON short_approvals
+    FOR EACH STATEMENT EXECUTE FUNCTION ps_append_only();
+
+-- ---------------------------------------------------------------- C8: per-department checklists
+
+-- Gitea issue 23. The checklist a stage uses is frozen when work starts on it. NULL means the stage has not started
+-- and reads its department's live template, so a template change reaches packets not yet started only.
+ALTER TABLE packet_stages ADD COLUMN checklist_template jsonb;
+
+-- Stages already started before this migration freeze the list they use today (the default for their kind), so a
+-- later department edit does not reach them. No department has its own list yet.
+UPDATE packet_stages s
+   SET checklist_template = t.value -> (CASE WHEN d.weld THEN 'weld' ELSE 'plain' END)
+  FROM packets p, departments d, settings t
+ WHERE p.id = s.packet_id AND d.code = s.dept_code AND t.key = 'checklist_templates'
+   AND s.closed_at IS NULL AND p.status IN ('in_progress', 'review', 'qc')
+   AND jsonb_typeof(t.value -> (CASE WHEN d.weld THEN 'weld' ELSE 'plain' END)) = 'array';
+
+-- Explicit, after the default privileges: the app may only read and append the approvals.
+REVOKE UPDATE, DELETE, TRUNCATE ON short_approvals FROM ps_app;
+GRANT SELECT, INSERT ON short_approvals TO ps_app;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ps_app;