Initial commit: PESCO NCR system

Complete Non-Conformance Report system replacing the PowerApps/SharePoint
prototype: FastAPI + SQLAlchemy 2 (async) + Alembic + MySQL 8 backend,
React 18 + Vite + TypeScript + MUI frontend, Entra ID auth (MSAL / JWKS,
group-gated), Microsoft Graph delegated Mail.Send notifications (OBO),
six-stage workflow state machine with server-side enforcement, atomic
NCR-YYYY-NNNN numbering, attachments with camera capture, immutable
field-level audit trail, admin reopen, reports + CSV export, WeasyPrint
PDF traveler, Power BI reporting views + read-only DB user, documented
VISUAL ERP job-lookup stub, pytest suite (26 tests), docker-compose
deployment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/routers/users.py

@@ -0,0 +1,55 @@
+from fastapi import APIRouter, Depends, Query
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.auth.deps import CurrentUser, get_current_user
+from app.config import get_settings
+from app.database import get_db
+from app.domain import ALL_ROLES
+from app.models import User, UserRole
+from app.schemas.user import MeOut, UserOut
+
+router = APIRouter(tags=["users"])
+
+
+@router.get("/me", response_model=MeOut)
+async def get_me(current: CurrentUser = Depends(get_current_user)) -> MeOut:
+    u = current.user
+    return MeOut(
+        id=u.id,
+        display_name=u.display_name,
+        email=u.email,
+        employee_id=u.employee_id,
+        is_active=u.is_active,
+        roles=sorted(current.roles),
+        last_login_at=u.last_login_at,
+        auth_mode=get_settings().auth_mode,
+    )
+
+
+@router.get("/users", response_model=list[UserOut])
+async def list_users(
+    role: str | None = Query(default=None, description="Filter to users holding this role"),
+    _: CurrentUser = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+) -> list[UserOut]:
+    """User directory for pickers (e.g. Disposition Authority dropdown,
+    'Notify These People'). Only active users are returned."""
+    stmt = select(User).where(User.is_active.is_(True)).order_by(User.display_name)
+    if role:
+        if role not in ALL_ROLES:
+            return []
+        stmt = stmt.join(UserRole, UserRole.user_id == User.id).where(UserRole.role == role)
+    users = (await db.execute(stmt)).scalars().unique().all()
+    return [
+        UserOut(
+            id=u.id,
+            display_name=u.display_name,
+            email=u.email,
+            employee_id=u.employee_id,
+            is_active=u.is_active,
+            roles=u.roles,
+            last_login_at=u.last_login_at,
+        )
+        for u in users
+    ]