wip: ops admin panel + migration sync + crud/rbac phase-5 snapshot

Working-tree checkpoint of in-progress work carried across prior
sessions on the feat/crud-rbac branch, committed so it lands on the
remote alongside the CI changes.

- Operaciones admin panel: apps/api/src/ops (ingest upload, backup /
  restore / re-import jobs) wired into app.module + RBAC abilities, and
  the apps/web/src/app/operaciones page. docker-compose gets INGEST_DIR
  / BACKUP_DIR volumes; .gitignore excludes migration/ingest + backups.
- migration/sync.py plus transform_*.py / run_all / config / dbenv /
  blob_extract adjustments for the additive sync path.
- crud/rbac phase-5 web bits: AppShell, api/labels/types libs, globals.
- schema.prisma + PLAN/RESUME doc updates.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/web/src/components/AppShell.tsx

@@ -22,6 +22,7 @@ const NAV: { href: string; label: string; ability?: Ability }[] = [
   { href: "/banco", label: "Chequera" },
   { href: "/catalogos", label: "Catálogos", ability: "lookup:manage" },
   { href: "/usuarios", label: "Usuarios", ability: "user:manage" },
+  { href: "/operaciones", label: "Operaciones", ability: "db:manage" },
 ];
 
 export function AppShell({ children }: { children: ReactNode }) {