OpenClear 1.12.0

Tools for the bank's staff and for whoever runs the installation, and for putting OpenClear
behind an edge network. It brings:

• the customer hub: customers with items to decide first, and "send a reminder now";
• platform staff, the operator view across banks, and setting up a bank from the web;
• support access granted by a bank, instead of impersonation;
• the edge check and the edge deployment guide for Cloudflare, Akamai and others.

Bank staff and operator (MASTER_PLAN.md M6)

• The customer hub. The Customers list puts customers with items to decide first, with
  open items, items due today, the next deadline, the last issued-check file and the decision
  default at the deadline; search, and "No issue file in N days". A customer's page shows its
  open items and has Send a reminder now. The exceptions list filters by customer for bank
  staff (?customer=).
• Platform staff. People who run the installation (scripts/platform_staff.py, operator
  or support) sign in at /ui/platform/login, separately from any bank.
• The operator view (/ui/platform): every bank's customers, open and overdue
  exceptions, jobs, last import, controls and security-event delivery; setting up a bank from
  the web, with a first admin who sets their own password.
• Support access instead of impersonation. Settings → Support access grants a named
  support person access for a reason and a period (up to 72 hours), read-only unless a second
  admin approves write access, never to decide items or see secrets, users, groups, settings
  or the action log. They work under their own name, with a banner; ending the grant or its
  time running out ends the session at once. Every grant, approval, use and end is in the
  action log, as a security event, and in the evidence export.
• Accessibility: a table that scrolls sideways is now reachable by keyboard (focusable,
  and named, only while it overflows).
• Migration f3b5d7f9b1c4: support_access_grant, and the platform role on users.

Edges (MASTER_PLAN.md M7)

• The edge check, scripts/edge_check.py <url> [--origin <origin>] [--expect-ip <ip>]:
  through Cloudflare, Akamai or a load balancer, it checks that OpenClear sees the caller's
  real address, the origin refuses requests that go around the edge, security headers arrive
  unaltered and nothing is injected, pages and the API aren't cached while static files are,
  responses are compressed, and legitimate requests (X9.37 and NACHA uploads, a large SAML
  response, SCIM, markdown with HTML-like text, URLs in settings, a burst of API calls) get
  through the WAF and bot management. It needs no account and changes nothing; --json for
  a report; exits 1 on a failure.
• GET /api/v1/edge/echo: how OpenClear saw the request (the caller's address and where
  it came from, whether the edge was trusted, the edge headers, the request id). No sign-in.
• The edge deployment guide, docs/guides/edge.md: origin lockdown, settings, WAF
  exceptions path by path, bot management, features to turn off, caching, sizes and timeouts,
  error pages, a go-live checklist, and notes for CloudFront, Azure Front Door and F5.
• scripts/edge_ip_ranges.py cloudflare prints Cloudflare's ranges for
  OPENCLEAR_TRUSTED_PROXY_CIDRS.
• Tested against a stub edge in the suite (tests/stub_edge.py) that behaves like Cloudflare
  and Akamai, including the mistakes real setups make; a real zone confirms it later.