Use NCR business number in URLs (/ncrs/NCR-2026-0021)

Detail routes, queue navigation, and notification email links now use the
business identifier instead of the database id — friendlier for end users
quoting NCR numbers. The API resolves both forms (case-insensitive number,
or legacy numeric id) so existing bookmarks and email links keep working.
Adds regression tests incl. a guard that /ncrs/export.csv isn't shadowed
by the path parameter.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/pages/NcrDetailPage.tsx

@@ -325,9 +325,10 @@ function DetailBody({ ncr }: { ncr: NcrDetail }) {
 }
 
 export function NcrDetailPage() {
+  // URL carries the NCR business number (e.g. /ncrs/NCR-2026-0021); numeric
+  // ids from older links still resolve server-side.
   const { id } = useParams();
-  const ncrId = Number(id);
-  const ncrQuery = useNcr(Number.isFinite(ncrId) ? ncrId : undefined);
+  const ncrQuery = useNcr(id);
   const me = useMe();
   const { toast } = useToast();
   const [tab, setTab] = useState(0);