wip: ops admin panel + migration sync + crud/rbac phase-5 snapshot

Working-tree checkpoint of in-progress work carried across prior
sessions on the feat/crud-rbac branch, committed so it lands on the
remote alongside the CI changes.

- Operaciones admin panel: apps/api/src/ops (ingest upload, backup /
  restore / re-import jobs) wired into app.module + RBAC abilities, and
  the apps/web/src/app/operaciones page. docker-compose gets INGEST_DIR
  / BACKUP_DIR volumes; .gitignore excludes migration/ingest + backups.
- migration/sync.py plus transform_*.py / run_all / config / dbenv /
  blob_extract adjustments for the additive sync path.
- crud/rbac phase-5 web bits: AppShell, api/labels/types libs, globals.
- schema.prisma + PLAN/RESUME doc updates.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

migration/run_all.py

@@ -39,13 +39,21 @@ PY = sys.executable  # the venv python running this orchestrator
 # service_documents / policy_documents, which would otherwise leave the
 # uploaded MinIO objects with no rows pointing at them.
 STEPS = [
-    "transform_customers.py",     # customers + customer_legacy_refs (everything FKs to these)
-    "transform_properties.py",    # properties + services + trust accounts
-    "transform_policies.py",      # policies + installments/vehicles/drivers/benef/claims/adjusters
-    "transform_transactions.py",  # shared ledger + type_transactions + exchange_rates
-    "prune_empty_customers.py",   # drop customers with no property/policy/transaction
-    "transform_bank.py",          # SCOTHIA bank register (no customer FK; independent)
-    "blob_extract.py",            # document pointers; must follow properties + policies
+    "transform_customers.py",
+    "transform_properties.py",
+    "transform_policies.py",
+    "transform_transactions.py",
+    "prune_empty_customers.py",
+    "transform_bank.py",
+    "blob_extract.py",
+]
+
+SYNC_STEPS = [
+    "transform_customers.py",
+    "transform_properties.py",
+    "transform_policies.py",
+    "transform_transactions.py",
+    "transform_bank.py",
 ]
 
 
@@ -61,13 +69,18 @@ def main() -> None:
     ap.add_argument("--env", default="dev", help="target environment (reads deploy/.env.<env>)")
     ap.add_argument("--stage", action="store_true",
                     help="re-run the raw staging load first (needs the Access files + mdbtools)")
+    ap.add_argument("--sync", action="store_true",
+                    help="upsert legacy rows and archive removed legacy rows; preserve manual rows")
     args = ap.parse_args()
 
     if args.stage:
         run([PY, str(HERE / "load_staging.py"), "--output-dir", str(HERE / "output")])
 
-    for step in STEPS:
-        run([PY, str(HERE / step), "--env", args.env])
+    for step in SYNC_STEPS if args.sync else STEPS:
+        cmd = [PY, str(HERE / step), "--env", args.env]
+        if args.sync:
+            cmd.append("--sync")
+        run(cmd)
 
     print(f"\n✓ migration complete for env={args.env}")