Phase 9: Admin completion, reconcile, notifications, integrity, backups

Admin: Departments (name and stations; add shows the three groups IT must
create), Profiles (welder stamp, station limits, active) with a CSV import
that previews and applies only when clean, Checklists (weld and plain),
Security (session, lockout and rate-limit settings with bounds, alerts for
the last 24 hours, the integrity result), Access log with filters and a
guarded CSV, Who is in, Stamp check, Notifications, and the employeeID
flags. Every Admin change is audited.

Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh
(15 minutes), integrity (seals, asset hashes, missing and orphan files, the
audit chain), backup-check, notify-send and notify-digest. Notifications
route per event type to AD groups, users, mailboxes or the department
Supervisor group, immediately or in a daily digest, over STARTTLS verified
against the PESCO CA, with dry run on the test stack.

Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer
at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21.
CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19.

Migration 0010. Closes the app part of I6, M3, O1, O2 and S3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

server/packetstation/domain/shop.py

@@ -405,14 +405,15 @@ PEOPLE_SQL = """
 SELECT u.id, u.display_name, u.welder_stamp, max(CASE r.role::text WHEN 'shop_supervisor' THEN 3
        WHEN 'shop_lead' THEN 2 ELSE 1 END) AS level
 FROM users u JOIN user_roles r ON r.user_id = u.id
-WHERE u.active AND r.dept_code = %s AND r.role::text IN ('shop_worker', 'shop_lead', 'shop_supervisor')
+WHERE u.active AND u.profile_active AND r.dept_code = %s
+  AND r.role::text IN ('shop_worker', 'shop_lead', 'shop_supervisor')
 GROUP BY u.id, u.display_name, u.welder_stamp
 ORDER BY lower(u.display_name), u.id
 """
 
 
 def people(conn: Any, dept: str) -> list[dict[str, Any]]:
-    """The active users with a shop role in a department, for the welder picker."""
+    """The active users with a shop role in a department, for the welder picker. An inactive profile is left out."""
     found = packets.rows(conn, PEOPLE_SQL, (dept,))
     limits: dict[str, list[int]] = {}
     if found: