Release v1.3.2: BUILD REPORT, Onshape settings UI, hierarchical seed templates

[abbyfluoroethane]

Summary

Two feature commits plus the v1.3.2 version bump.

BUILD REPORT, expanded MCP procedure tools, hierarchical seed templates (d73b421)

• New printable /executions/{id}/report page with closeout-photo support — new attachment kind closeout, PATCH /api/attachments/{id}, template + CSS, smoke test.
• MCP server: full procedure CRUD (get/update/delete procedure & steps, reorder, dependencies, kit/output management, step kit, publish_version, list_versions, clone_procedure) plus create_risk. Adds mcp>=1.0 dep.
• opal migrate now honors --project / --database so migrations target the right project DB.
• Seed: rewrite all 6 procedures into operation/step hierarchy (52 ops, 194 sub-steps with requires_signoff / required_data_schema on measurement & verification steps); add default users (admin id=1 + two non-admins); embed parent_step_id / kit_items / output_items in version snapshots so executions render the tree.

Onshape settings UI (07b0194)

Admin-only /settings/onshape/configure form so credentials can be entered, edited, and tested without touching .env.

• New AppSetting model + migration for runtime-mutable key/value config that survives restarts and overrides env values.
• apply_db_overlay() rebuilds runtime Settings from app_setting rows at server lifespan startup and after each save.
• OnshapeClient.get_session_info() powers the TEST CONNECTION button; bad credentials surface as a friendly "Authentication failed" banner instead of a raw JSON decode error.
• Settings index always shows the ONSHAPE INTEGRATION panel: CONFIGURE button when disabled, EDIT alongside PULL/PUSH when enabled.
• Form follows the standard OPAL panel + form_actions style; reuses ok.status and var(--accent-*) for messaging. Drops broken .alert classes in onshape_documents.html for the standard inline-color flash style.

Test plan

• ruff format + ruff check src/ clean
• pytest tests/unit/ — 308 passed
• Fresh opal seed runs end-to-end with the new hierarchical templates (246 steps across 6 procedures)
• /settings/onshape/configure flow exercised: save → status flips to ENABLED, TEST CONNECTION with bad keys returns the friendly auth-failed banner
• Manual: run a real BUILD REPORT on a completed execution
• Manual: real Onshape keypair, confirm Connected as <name> banner