Detail routes, queue navigation, and notification email links now use the
business identifier instead of the database id — friendlier for end users
quoting NCR numbers. The API resolves both forms (case-insensitive number,
or legacy numeric id) so existing bookmarks and email links keep working.
Adds regression tests incl. a guard that /ncrs/export.csv isn't shadowed
by the path parameter.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Passing the DB URL through config.set_main_option() runs it through
ConfigParser, which treats '%' as interpolation syntax — so any password
character that URL-encodes to %xx ('!', '@', '#', ...) crashed migrations
('invalid interpolation syntax'). Build the engine directly from the URL
instead of routing it through the ini config.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>