Add API Q1 CAPA: root cause, corrective action gate, effectiveness verification

Implements tester feedback against API Q1 §5.9.1.2 / §6.4.2:

- Root Cause field + 6M Root Cause Category lookup (Man/Machine/Method/
  Material/Measurement/Environment), separate from Deviation Detail/Category
- "Corrective Action Required?" Yes/No gate on every NCR with a required
  justification
- Corrective action plan with owner + due date; owner is notified by email
- Effectiveness verification (result, notes, server-stamped verifier/date)
  required before an NCR can close when corrective action is required —
  costing returns 409 listing the missing pieces
- Recurring-issue flag with bidirectional NCR-to-NCR links; prior NCRs show
  a warning when later NCRs reference them
- Dashboard metrics: % root cause completed, % CAPA verified effective,
  avg CAPA close time, overdue CAPA count, NCRs by root cause category
- CAPA section in the NCR detail UI, printable PDF, CSV export, and the
  vw_ncr_full Power BI view; admin list manager for root cause categories
- Migrations 0003 (schema + seeded 6M lookup) and 0004 (view refresh);
  demo seed data exercises every metric

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/tests/test_state_machine.py

@@ -1,6 +1,7 @@
 """Workflow state machine: happy paths, invalid transitions, closure locking,
 admin reopen, and rich-text sanitization."""
 from .util import (
+    answer_capa_no,
     create_ncr,
     do_initial_disposition,
     hdr,
@@ -47,15 +48,22 @@ async def test_full_lifecycle_direct_to_operations(client, team):
     assert body["stage"] == "costing"
     assert body["qc_closed"] is True
 
+    # the API Q1 CAPA gate blocks closure until the CA question is answered
+    costing_body = {
+        "labor_cost": "100.00",
+        "material_cost": "50.25",
+        "service_cost": "0",
+        "other_cost": "10",
+    }
     r = await client.post(
-        f"/api/ncrs/{ncr['id']}/costing",
-        json={
-            "labor_cost": "100.00",
-            "material_cost": "50.25",
-            "service_cost": "0",
-            "other_cost": "10",
-        },
-        headers=hdr(team["cost"]),
+        f"/api/ncrs/{ncr['id']}/costing", json=costing_body, headers=hdr(team["cost"])
+    )
+    assert r.status_code == 409
+    assert "Corrective Action Required" in r.json()["detail"]
+    await answer_capa_no(client, team, ncr["id"])
+
+    r = await client.post(
+        f"/api/ncrs/{ncr['id']}/costing", json=costing_body, headers=hdr(team["cost"])
     )
     body = r.json()["ncr"]
     assert body["stage"] == "closed"