Phase 9: Admin completion, reconcile, notifications, integrity, backups

Admin: Departments (name and stations; add shows the three groups IT must
create), Profiles (welder stamp, station limits, active) with a CSV import
that previews and applies only when clean, Checklists (weld and plain),
Security (session, lockout and rate-limit settings with bounds, alerts for
the last 24 hours, the integrity result), Access log with filters and a
guarded CSV, Who is in, Stamp check, Notifications, and the employeeID
flags. Every Admin change is audited.

Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh
(15 minutes), integrity (seals, asset hashes, missing and orphan files, the
audit chain), backup-check, notify-send and notify-digest. Notifications
route per event type to AD groups, users, mailboxes or the department
Supervisor group, immediately or in a daily digest, over STARTTLS verified
against the PESCO CA, with dry run on the test stack.

Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer
at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21.
CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19.

Migration 0010. Closes the app part of I6, M3, O1, O2 and S3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.gitea/workflows/ci.yml

@@ -68,6 +68,18 @@ jobs:
           pip install -r "$RUNNER_TEMP/dev-requirements.txt"
           pip check
 
+      # Requirement S3. Audits every pin in server/requirements.txt (transitive included) against
+      # the PyPI advisory database. visualkit and mfileskit are not on PyPI: they come from the Gitea
+      # index (requirements-pesco.txt) and are not audited here. pip-audit has no severity filter, so
+      # any known vulnerability fails the job, which covers high and critical. pip-audit runs from its
+      # own venv so its dependencies never touch the pinned set above.
+      - name: Dependency scan (pip-audit)
+        run: |
+          set -euo pipefail
+          python -m venv "$RUNNER_TEMP/audit"
+          "$RUNNER_TEMP/audit/bin/pip" install --quiet pip-audit==2.9.0
+          "$RUNNER_TEMP/audit/bin/pip-audit" -r server/requirements.txt --no-deps --disable-pip --progress-spinner off
+
       - name: Lint (ruff)
         run: |
           ruff check .
@@ -95,6 +107,9 @@ jobs:
 
       - name: Install
         run: npm ci --no-audit --no-fund
+      # Requirement S3. Fails on a high or critical advisory in any dependency, dev tools included.
+      - name: Dependency scan (npm audit)
+        run: npm audit --audit-level=high
       - name: Lint
         run: npm run lint
       - name: Types (tsc)
@@ -159,7 +174,7 @@ jobs:
       - name: Generate feed fixtures
         run: |
           set -euo pipefail
-          python -m pip install pypdf==6.21.0
+          python -m pip install pypdf==6.21.1
           python -m tests.fixtures.generator --out tests/fixtures/generated
           # The Playwright container writes state; the worker reads as uid 10001.
           chmod -R a+rwX tests/fixtures/generated