Initial commit: PESCO NCR system

Complete Non-Conformance Report system replacing the PowerApps/SharePoint
prototype: FastAPI + SQLAlchemy 2 (async) + Alembic + MySQL 8 backend,
React 18 + Vite + TypeScript + MUI frontend, Entra ID auth (MSAL / JWKS,
group-gated), Microsoft Graph delegated Mail.Send notifications (OBO),
six-stage workflow state machine with server-side enforcement, atomic
NCR-YYYY-NNNN numbering, attachments with camera capture, immutable
field-level audit trail, admin reopen, reports + CSV export, WeasyPrint
PDF traveler, Power BI reporting views + read-only DB user, documented
VISUAL ERP job-lookup stub, pytest suite (26 tests), docker-compose
deployment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/docker-entrypoint.d/50-config.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+# Generates the SPA's runtime configuration from container environment
+# variables (nginx image runs every /docker-entrypoint.d/*.sh on start).
+set -e
+
+API_SCOPE="${ENTRA_API_SCOPE}"
+if [ -z "$API_SCOPE" ] && [ -n "$ENTRA_CLIENT_ID" ]; then
+  API_SCOPE="api://${ENTRA_CLIENT_ID}/access_as_user"
+fi
+
+cat > /usr/share/nginx/html/config.js <<EOF
+window.__APP_CONFIG__ = {
+  authMode: "${AUTH_MODE:-entra}",
+  tenantId: "${ENTRA_TENANT_ID}",
+  clientId: "${ENTRA_CLIENT_ID}",
+  apiScope: "${API_SCOPE}"
+};
+EOF
+
+echo "[frontend] config.js generated (authMode=${AUTH_MODE:-entra})"