Initial commit: PESCO NCR system

Complete Non-Conformance Report system replacing the PowerApps/SharePoint
prototype: FastAPI + SQLAlchemy 2 (async) + Alembic + MySQL 8 backend,
React 18 + Vite + TypeScript + MUI frontend, Entra ID auth (MSAL / JWKS,
group-gated), Microsoft Graph delegated Mail.Send notifications (OBO),
six-stage workflow state machine with server-side enforcement, atomic
NCR-YYYY-NNNN numbering, attachments with camera capture, immutable
field-level audit trail, admin reopen, reports + CSV export, WeasyPrint
PDF traveler, Power BI reporting views + read-only DB user, documented
VISUAL ERP job-lookup stub, pytest suite (26 tests), docker-compose
deployment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/powerbi_grants.sql

@@ -0,0 +1,14 @@
+-- Re-runnable script to (re)create the read-only Power BI reporting account.
+-- Use when the MySQL volume was initialized before POWERBI_RO_PASSWORD was set:
+--
+--   docker compose exec -T mysql \
+--     sh -c 'mysql -u root -p"$MYSQL_ROOT_PASSWORD" "$MYSQL_DATABASE"' < scripts/powerbi_grants.sql
+--
+-- Then set the password (replace the placeholder):
+--   ALTER USER 'powerbi_ro'@'%' IDENTIFIED BY '<POWERBI_RO_PASSWORD>';
+
+CREATE USER IF NOT EXISTS 'powerbi_ro'@'%' IDENTIFIED BY 'CHANGE_ME_NOW';
+GRANT SELECT ON `pesco_ncr`.`vw_ncr_full`          TO 'powerbi_ro'@'%';
+GRANT SELECT ON `pesco_ncr`.`vw_ncr_stage_history` TO 'powerbi_ro'@'%';
+GRANT SELECT ON `pesco_ncr`.`vw_ncr_costs`         TO 'powerbi_ro'@'%';
+FLUSH PRIVILEGES;