wip: ops admin panel + migration sync + crud/rbac phase-5 snapshot

Working-tree checkpoint of in-progress work carried across prior
sessions on the feat/crud-rbac branch, committed so it lands on the
remote alongside the CI changes.

- Operaciones admin panel: apps/api/src/ops (ingest upload, backup /
  restore / re-import jobs) wired into app.module + RBAC abilities, and
  the apps/web/src/app/operaciones page. docker-compose gets INGEST_DIR
  / BACKUP_DIR volumes; .gitignore excludes migration/ingest + backups.
- migration/sync.py plus transform_*.py / run_all / config / dbenv /
  blob_extract adjustments for the additive sync path.
- crud/rbac phase-5 web bits: AppShell, api/labels/types libs, globals.
- schema.prisma + PLAN/RESUME doc updates.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

migration/config.py

@@ -17,9 +17,17 @@ not work on macOS; extraction is being reworked to use mdbtools
 the four Access source files.
 """
 
+import os
 from pathlib import Path
 
-SOURCE_ROOT = Path.home() / "Downloads" / "JorgeCuadros-Legacy"
+# The folder holding the four Access source files. Overridable via INGEST_DIR so
+# the web "Operaciones" ingest folder (a mounted volume in the API container)
+# feeds the same pipeline. Falls back to the original macOS download location
+# for a plain local run.
+SOURCE_ROOT = Path(
+    os.environ.get("INGEST_DIR")
+    or (Path.home() / "Downloads" / "JorgeCuadros-Legacy")
+)
 
 SOURCES = {
     "utilities": {