Add API Q1 CAPA: root cause, corrective action gate, effectiveness verification

Implements tester feedback against API Q1 §5.9.1.2 / §6.4.2:

- Root Cause field + 6M Root Cause Category lookup (Man/Machine/Method/
  Material/Measurement/Environment), separate from Deviation Detail/Category
- "Corrective Action Required?" Yes/No gate on every NCR with a required
  justification
- Corrective action plan with owner + due date; owner is notified by email
- Effectiveness verification (result, notes, server-stamped verifier/date)
  required before an NCR can close when corrective action is required —
  costing returns 409 listing the missing pieces
- Recurring-issue flag with bidirectional NCR-to-NCR links; prior NCRs show
  a warning when later NCRs reference them
- Dashboard metrics: % root cause completed, % CAPA verified effective,
  avg CAPA close time, overdue CAPA count, NCRs by root cause category
- CAPA section in the NCR detail UI, printable PDF, CSV export, and the
  vw_ncr_full Power BI view; admin list manager for root cause categories
- Migrations 0003 (schema + seeded 6M lookup) and 0004 (view refresh);
  demo seed data exercises every metric

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/routers/admin.py

@@ -14,6 +14,7 @@ from app.models import (
     Department,
     DeviationCategory,
     Ncr,
+    RootCauseCategory,
     User,
     UserRole,
 )
@@ -178,6 +179,39 @@ async def patch_category(
     )
 
 
+@router.get("/root-cause-categories", response_model=list[NamedLookupOut])
+async def list_root_cause_categories(
+    _: CurrentUser = Depends(require_admin), db: AsyncSession = Depends(get_db)
+):
+    rows = (
+        (await db.execute(select(RootCauseCategory).order_by(RootCauseCategory.name)))
+        .scalars()
+        .all()
+    )
+    return [NamedLookupOut.model_validate(r) for r in rows]
+
+
+@router.post("/root-cause-categories", response_model=NamedLookupOut, status_code=201)
+async def create_root_cause_category(
+    payload: LookupCreateIn,
+    current: CurrentUser = Depends(require_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    return await _create_lookup(RootCauseCategory, "Root cause category", payload, current, db)
+
+
+@router.patch("/root-cause-categories/{item_id}", response_model=NamedLookupOut)
+async def patch_root_cause_category(
+    item_id: int,
+    payload: LookupPatchIn,
+    current: CurrentUser = Depends(require_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    return await _patch_lookup(
+        RootCauseCategory, "Root cause category", item_id, payload, current, db
+    )
+
+
 async def _create_lookup(model, label, payload, current, db) -> NamedLookupOut:
     exists = (
         await db.execute(select(model).where(model.name == payload.name.strip()))