wip: ops admin panel + migration sync + crud/rbac phase-5 snapshot

Working-tree checkpoint of in-progress work carried across prior
sessions on the feat/crud-rbac branch, committed so it lands on the
remote alongside the CI changes.

- Operaciones admin panel: apps/api/src/ops (ingest upload, backup /
  restore / re-import jobs) wired into app.module + RBAC abilities, and
  the apps/web/src/app/operaciones page. docker-compose gets INGEST_DIR
  / BACKUP_DIR volumes; .gitignore excludes migration/ingest + backups.
- migration/sync.py plus transform_*.py / run_all / config / dbenv /
  blob_extract adjustments for the additive sync path.
- crud/rbac phase-5 web bits: AppShell, api/labels/types libs, globals.
- schema.prisma + PLAN/RESUME doc updates.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

migration/blob_extract.py

@@ -38,7 +38,9 @@ from extract import sanitize_column_name as san
 
 csv.field_size_limit(300_000_000)
 
-SOURCE_ROOT = Path.home() / "Downloads" / "JorgeCuadros-Legacy"
+# Same source folder as the rest of the pipeline (config.SOURCE_ROOT honours
+# INGEST_DIR — the web "Operaciones" ingest volume).
+from config import SOURCE_ROOT
 
 # (key, access_file, access_table, staged_table_name, blob_cols, model)
 SOURCES = [