Add API Q1 CAPA: root cause, corrective action gate, effectiveness verification

Implements tester feedback against API Q1 §5.9.1.2 / §6.4.2:

- Root Cause field + 6M Root Cause Category lookup (Man/Machine/Method/
  Material/Measurement/Environment), separate from Deviation Detail/Category
- "Corrective Action Required?" Yes/No gate on every NCR with a required
  justification
- Corrective action plan with owner + due date; owner is notified by email
- Effectiveness verification (result, notes, server-stamped verifier/date)
  required before an NCR can close when corrective action is required —
  costing returns 409 listing the missing pieces
- Recurring-issue flag with bidirectional NCR-to-NCR links; prior NCRs show
  a warning when later NCRs reference them
- Dashboard metrics: % root cause completed, % CAPA verified effective,
  avg CAPA close time, overdue CAPA count, NCRs by root cause category
- CAPA section in the NCR detail UI, printable PDF, CSV export, and the
  vw_ncr_full Power BI view; admin list manager for root cause categories
- Migrations 0003 (schema + seeded 6M lookup) and 0004 (view refresh);
  demo seed data exercises every metric

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -160,6 +160,7 @@ to send mail (`backend/app/services/graph.py`).
 | Operations complete | all QC Inspectors | operations user |
 | QC closed | all Costing users | QC inspector |
 | NCR closed | original requester | costing user |
+| Corrective action assigned | the CA owner | user who assigned it |
 | Admin reopen | owners of the target stage + requester | admin |
 
 Fault tolerance: a Graph failure **never blocks a workflow transition** — the
@@ -186,9 +187,18 @@ Notes:
   People" users (their personal queue) and Admins; they may update disposition
   fields and release to Operations.
 - **QC Inspection** can be saved repeatedly until *QC Closed* advances it.
-- Saving **Costing** (Labor/Material/Service/Other) closes the NCR. Closed
-  NCRs are fully read-only — including attachments — until an Admin reopens
-  them (required reason, recorded in the audit trail).
+- The **CAPA section** (API Q1 §5.9.1.2 / §6.4.2) sits outside the stage
+  sequence: QC Inspectors, Disposition Authorities, and Admins can edit it at
+  any point before closure (`POST /ncrs/{ref}/capa`). It captures the root
+  cause (+ 6M root cause category), the *Corrective Action Required?* Yes/No
+  gate with justification, the action plan (owner + due date, owner is
+  notified), effectiveness verification (server-stamped verifier/date), and
+  the recurring-issue flag with links to prior NCRs.
+- Saving **Costing** (Labor/Material/Service/Other) closes the NCR — but only
+  once the CAPA gate passes: the CA question must be answered, and when the
+  answer is Yes the plan must be complete and verified *effective* (HTTP 409
+  otherwise). Closed NCRs are fully read-only — including attachments — until
+  an Admin reopens them (required reason, recorded in the audit trail).
 - Every stage change writes a `stage_transitions` row (timestamp + acting
   user) — the basis for the aging and cycle-time reports — and every field
   change writes an immutable `audit_log` row (before/after values). The app