perf: index the real queries, bound the board, and correct what the Site promises

Five items that needed no decisions.

Indexes: the schema indexed only uploads(owner), so the worker's once-a-second
outbox poll scanned a table that only grows, and every per-customer and
per-order lookup did the same. Ten indexes now follow queries the application
actually issues, and no more, since each one is paid for on every write. The
outbox and live uploads use partial indexes so they stay the size of the backlog
rather than of all history. Confirmed against the database that the planner
chooses them.

Board: /api/operator/board returned every order ever created. Finished orders
are terminal, so they were pure growth. It now returns everything still in
progress however old, plus a window of recent finished ones and the true
finished total, and the Kanban column says "50 de 213" rather than letting the
count read as an all-time figure. An operator cannot lose a card they could act
on.

Dependencies: the root requirements.txt was the prototype's, pinned by wildcard,
listing packages this system does not use, next to the hash-locked lock file.
Deleted. pip was pinned as a runtime dependency, which installed a package
manager into the read-only production image; nothing depended on it, so it is
gone from both the direct list and the lock, and the base image's pip performs
the hash-enforced install.

Retention copy: the Site told customers their artwork was kept 90 days with 12
months of history, and invited them to reorder without uploading again. Files
are kept 30 days. The copy now matches the policy and drops the promise the
system cannot keep.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

local/app.py

@@ -34,6 +34,11 @@ ALLOWED_ORIGINS = [origin for origin in os.environ.get('ALLOWED_ORIGINS', PUBLIC
 # offices and mobile carriers put many real customers behind one address, so a
 # tight per-IP ceiling would lock out the same people the old global one did.
 GUEST_SESSION_LIMIT = int(os.environ.get('GUEST_SESSION_LIMIT', '240'))
+# The board returned every order ever created. Finished ones are terminal, so
+# they were pure growth: at a few hundred a day the response and the page both
+# degrade with no operator benefit.
+BOARD_FINISHED_LIMIT = int(os.environ.get('BOARD_FINISHED_LIMIT', '50'))
+BOARD_QUOTE_LIMIT = int(os.environ.get('BOARD_QUOTE_LIMIT', '100'))
 PART_BYTES = int(os.environ.get('UPLOAD_PART_BYTES', '8388608'))
 if not 5242880 <= PART_BYTES <= 67108864:
     raise RuntimeError('UPLOAD_PART_BYTES must be between 5 and 64 MiB')
@@ -284,9 +289,19 @@ def dev_paid(body: Pay, session_id=Depends(owner)):
 @app.get('/api/operator/board')
 def board(user=Depends(operator)):
     with db.connect() as c:
-        orders = c.execute('SELECT * FROM dtf_local.orders ORDER BY created_at').fetchall()
-        quotes = c.execute('SELECT q.* FROM dtf_local.quotes q LEFT JOIN dtf_local.orders o ON o.quote_id=q.id WHERE o.id IS NULL ORDER BY q.created_at').fetchall()
-        return {'states': STATES, 'transitions': TRANSITIONS, 'orders': orders,
+        # Everything still in progress, however old: an operator must never lose a
+        # card they can act on. Finished orders are terminal and only accumulate,
+        # so the board carries a recent window of them and reports the true total.
+        active = c.execute("SELECT * FROM dtf_local.orders WHERE state<>'fin' ORDER BY created_at").fetchall()
+        finished = c.execute("SELECT * FROM dtf_local.orders WHERE state='fin' ORDER BY created_at DESC LIMIT %s",
+                             (BOARD_FINISHED_LIMIT,)).fetchall()
+        finished_total = c.execute("SELECT count(*) AS n FROM dtf_local.orders WHERE state='fin'").fetchone()['n']
+        quotes = c.execute('''SELECT q.* FROM dtf_local.quotes q
+            LEFT JOIN dtf_local.orders o ON o.quote_id=q.id WHERE o.id IS NULL
+            ORDER BY q.created_at LIMIT %s''', (BOARD_QUOTE_LIMIT,)).fetchall()
+        return {'states': STATES, 'transitions': TRANSITIONS,
+                'orders': active + list(reversed(finished)),
+                'finished_shown': len(finished), 'finished_total': finished_total,
                 'quotes': [quote_view(c, q) for q in quotes],
                 'events': c.execute('SELECT * FROM dtf_local.outbox ORDER BY id DESC LIMIT 100').fetchall()}