Add API Q1 CAPA: root cause, corrective action gate, effectiveness verification

Implements tester feedback against API Q1 §5.9.1.2 / §6.4.2:

- Root Cause field + 6M Root Cause Category lookup (Man/Machine/Method/
  Material/Measurement/Environment), separate from Deviation Detail/Category
- "Corrective Action Required?" Yes/No gate on every NCR with a required
  justification
- Corrective action plan with owner + due date; owner is notified by email
- Effectiveness verification (result, notes, server-stamped verifier/date)
  required before an NCR can close when corrective action is required —
  costing returns 409 listing the missing pieces
- Recurring-issue flag with bidirectional NCR-to-NCR links; prior NCRs show
  a warning when later NCRs reference them
- Dashboard metrics: % root cause completed, % CAPA verified effective,
  avg CAPA close time, overdue CAPA count, NCRs by root cause category
- CAPA section in the NCR detail UI, printable PDF, CSV export, and the
  vw_ncr_full Power BI view; admin list manager for root cause categories
- Migrations 0003 (schema + seeded 6M lookup) and 0004 (view refresh);
  demo seed data exercises every metric

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/services/notifications.py

@@ -32,6 +32,7 @@ class NotifyEvent(str, Enum):
     QC_CLOSED = "qc_closed"
     CLOSED = "closed"
     REOPENED = "reopened"
+    CAPA_ASSIGNED = "capa_assigned"
 
 
 _EVENT_SUBJECT = {
@@ -42,6 +43,7 @@ _EVENT_SUBJECT = {
     NotifyEvent.QC_CLOSED: "QC closed — costing needed",
     NotifyEvent.CLOSED: "Your NCR has been closed",
     NotifyEvent.REOPENED: "NCR reopened by an administrator",
+    NotifyEvent.CAPA_ASSIGNED: "Corrective action assigned to you",
 }
 
 
@@ -74,6 +76,8 @@ async def _recipients(db: AsyncSession, ncr: Ncr, event: NotifyEvent) -> list[st
         return await _role_emails(db, Role.COSTING)
     if event == NotifyEvent.CLOSED:
         return [ncr.requester.email]
+    if event == NotifyEvent.CAPA_ASSIGNED:
+        return [ncr.corrective_action_owner.email] if ncr.corrective_action_owner else []
     if event == NotifyEvent.REOPENED:
         owner_role = STAGE_OWNER_ROLE.get(Stage(ncr.stage))
         emails = await _role_emails(db, owner_role) if owner_role else []

backend/app/services/pdf.py

@@ -23,7 +23,7 @@ _env = Environment(
 )
 
 
-def _render_html(ncr: Ncr) -> str:
+def _render_html(ncr: Ncr, related_ncr_numbers: list[str]) -> str:
     images = []
     other_files = []
     for att in ncr.attachments:
@@ -48,6 +48,7 @@ def _render_html(ncr: Ncr) -> str:
         Stage=Stage,
         images=images,
         other_files=other_files,
+        related_ncr_numbers=related_ncr_numbers,
         generated_at=utcnow(),
     )
 
@@ -58,7 +59,7 @@ def _html_to_pdf(html: str) -> bytes:
     return HTML(string=html).write_pdf()
 
 
-async def render_ncr_pdf(ncr: Ncr) -> bytes:
-    html = _render_html(ncr)
+async def render_ncr_pdf(ncr: Ncr, related_ncr_numbers: list[str] | None = None) -> bytes:
+    html = _render_html(ncr, related_ncr_numbers or [])
     # WeasyPrint rendering is CPU-bound; keep it off the event loop.
     return await anyio.to_thread.run_sync(partial(_html_to_pdf, html))