Phase 9: Admin completion, reconcile, notifications, integrity, backups

Admin: Departments (name and stations; add shows the three groups IT must
create), Profiles (welder stamp, station limits, active) with a CSV import
that previews and applies only when clean, Checklists (weld and plain),
Security (session, lockout and rate-limit settings with bounds, alerts for
the last 24 hours, the integrity result), Access log with filters and a
guarded CSV, Who is in, Stamp check, Notifications, and the employeeID
flags. Every Admin change is audited.

Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh
(15 minutes), integrity (seals, asset hashes, missing and orphan files, the
audit chain), backup-check, notify-send and notify-digest. Notifications
route per event type to AD groups, users, mailboxes or the department
Supervisor group, immediately or in a daily digest, over STARTTLS verified
against the PESCO CA, with dry run on the test stack.

Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer
at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21.
CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19.

Migration 0010. Closes the app part of I6, M3, O1, O2 and S3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

server/packetstation/worker/runs.py

@@ -18,6 +18,7 @@ from psycopg.types.json import Jsonb
 
 from .. import guard
 from ..feed import config
+from ..notify import watch
 from .jobs import JobContext, JobSpec
 from .redaction import clip, redact
 
@@ -65,6 +66,21 @@ def _target(result: Any) -> str:
     return text.rsplit(" (", 1)[0] if text.endswith(")") else text
 
 
+def _notify_feed(sch: Scheduler, conn: Any, name: str, status: str, errors: list[str], run_id: int) -> None:
+    """feed_failed and feed_degraded after a feed or drawing run. Never fails the run."""
+    if name not in watch.FEED_JOBS:
+        return
+    try:
+        conn.execute("SELECT 1")  # raise_event never raises, so find a broken connection first
+        watch.feed_run(conn, name, status, list(errors), run_id)
+    except Exception:
+        try:
+            with sch.connect() as c2:
+                watch.feed_run(c2, name, status, list(errors), run_id)
+        except Exception as e:
+            log.error("job %s: can't raise the feed notification: %s", name, type(e).__name__)
+
+
 def run_job(sch: Scheduler, name: str, trigger: str) -> dict[str, Any]:
     """Run `name` once and return its job_runs row. Never raises for a job failure; raises when the database
     cannot be reached at all (the caller logs it)."""
@@ -129,6 +145,7 @@ def run_job(sch: Scheduler, name: str, trigger: str) -> dict[str, Any]:
             # The run's connection is broken: write the result on a fresh one
             with sch.connect() as c2:
                 _finish(c2, run_id, status=status, counts=counts, errors=errors, visual_target=visual_target)
+        _notify_feed(sch, conn, name, status, errors, run_id)
         try:
             pending_after = bool(
                 conn.execute(