Use NCR business number in URLs (/ncrs/NCR-2026-0021)

Detail routes, queue navigation, and notification email links now use the
business identifier instead of the database id — friendlier for end users
quoting NCR numbers. The API resolves both forms (case-insensitive number,
or legacy numeric id) so existing bookmarks and email links keep working.
Adds regression tests incl. a guard that /ncrs/export.csv isn't shadowed
by the path parameter.

Co-Authored-By: Claude Fable 5 <[email protected]>

backend/app/services/notifications.py

@@ -85,7 +85,7 @@ async def _recipients(db: AsyncSession, ncr: Ncr, event: NotifyEvent) -> list[st
 
 def _build_body(ncr: Ncr, event: NotifyEvent, summary: str) -> str:
     e = html.escape
-    link = f"{get_settings().app_base_url}/ncrs/{ncr.id}"
+    link = f"{get_settings().app_base_url}/ncrs/{ncr.ncr_number}"
     rows = [
         ("NCR Number", ncr.ncr_number),
         ("Job Number", ncr.job_number),