Phase 9: Admin completion, reconcile, notifications, integrity, backups

Admin: Departments (name and stations; add shows the three groups IT must
create), Profiles (welder stamp, station limits, active) with a CSV import
that previews and applies only when clean, Checklists (weld and plain),
Security (session, lockout and rate-limit settings with bounds, alerts for
the last 24 hours, the integrity result), Access log with filters and a
guarded CSV, Who is in, Stamp check, Notifications, and the employeeID
flags. Every Admin change is audited.

Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh
(15 minutes), integrity (seals, asset hashes, missing and orphan files, the
audit chain), backup-check, notify-send and notify-digest. Notifications
route per event type to AD groups, users, mailboxes or the department
Supervisor group, immediately or in a daily digest, over STARTTLS verified
against the PESCO CA, with dry run on the test stack.

Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer
at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21.
CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19.

Migration 0010. Closes the app part of I6, M3, O1, O2 and S3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/server/test_schema.py

@@ -70,6 +70,11 @@ APPEND_INSERTS = {
     "print_log": (
         "INSERT INTO print_log (packet_id, kind, what, by) VALUES (%(packet)s, 'traveler', 'Job traveler', %(user)s)"
     ),
+    "notifications_sent": (
+        "INSERT INTO notifications_sent (event_type, subject, result, requested_by)"
+        " VALUES ('security_alert', 'Test', 'dry_run', %(user)s)"
+    ),
+    "integrity_findings": "INSERT INTO integrity_findings (run_id, kind, subject) VALUES (1, 'audit_chain', '1')",
 }
 APPEND_ONLY = list(APPEND_INSERTS)
 
@@ -402,7 +407,17 @@ def test_feed_tables_and_app_grants(pg_settings: Settings) -> None:
             for priv in ("SELECT", "INSERT", "UPDATE", "DELETE"):
                 assert one(conn, "SELECT has_table_privilege('ps_app', %s, %s)", (table, priv)) is True, (table, priv)
         jobs = [r[0] for r in conn.execute("SELECT job FROM job_schedule ORDER BY job").fetchall()]
-        assert jobs == ["drawing-lookup", "housekeeping", "visual-feed"]
+        assert jobs == [
+            "ad-reconcile",
+            "backup-check",
+            "drawing-lookup",
+            "housekeeping",
+            "integrity",
+            "notify-digest",
+            "notify-send",
+            "session-refresh",
+            "visual-feed",
+        ]
         assert one(conn, "SELECT target FROM visual_resource_map WHERE resource = 'WELD-PART'") == "03"
         assert one(conn, "SELECT target FROM visual_resource_map WHERE resource = 'Electical'") == "14"
         assert one(conn, "SELECT count(*) FROM visual_resource_map WHERE confirmed") == 0