Initial import: eCW Charge Validation bot and results Portal

Snapshot of the working project as of 2026-10-23 (local 2d4d4fc), one
commit with no earlier history: the tracked files were de-identified
first (synthetic claim ids and patient data only; see Context.md
section 7). Credentials, run logs, screenshots, claim reports and client
workbooks are gitignored and not included.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/sql/create_tables.sql

@@ -0,0 +1,98 @@
+-- eCW Charge Validation bot: results table for the Charge Summary rows.
+-- Run once in SSMS (as a login allowed to create tables) against
+-- MECARE331\MECARE331. Safe to run again: it skips an existing table.
+-- Every table of this project starts with CV_ (operator, 2026-10-12).
+--
+-- The 24 columns follow the team's Charge Summary File Format, plus the
+-- run columns and details_json. See src/ecw_bot/core/results_db.py.
+
+USE Charge_Validation;
+GO
+
+IF OBJECT_ID('dbo.CV_ChargeSummary', 'U') IS NULL
+BEGIN
+    CREATE TABLE dbo.CV_ChargeSummary (
+        id             INT IDENTITY(1,1) PRIMARY KEY,
+        run_at         DATETIME2      NOT NULL,
+        run_mode       NVARCHAR(20)   NOT NULL,  -- VERIFY / LIVE-WRITE, or TEST VERIFY / TEST LIVE-WRITE
+        s_no           INT            NULL,
+        claim_no       NVARCHAR(20)   NOT NULL,
+        service_date   DATE           NULL,
+        pvdr           NVARCHAR(50)   NULL,
+        patient        NVARCHAR(200)  NULL,
+        payer          NVARCHAR(200)  NULL,
+        group_name     NVARCHAR(100)  NULL,
+        status         NVARCHAR(100)  NULL,
+        charges        DECIMAL(12,2)  NULL,
+        pmts_adjs      DECIMAL(12,2)  NULL,
+        pmts_refunds   DECIMAL(12,2)  NULL,
+        adjustment     DECIMAL(12,2)  NULL,
+        withheld       DECIMAL(12,2)  NULL,
+        balance        DECIMAL(12,2)  NULL,
+        visit_type     NVARCHAR(100)  NULL,
+        account_number NVARCHAR(50)   NULL,
+        provider_name  NVARCHAR(200)  NULL,
+        guarantor_name NVARCHAR(200)  NULL,
+        received_date  DATE           NULL,
+        assigned_to    NVARCHAR(100)  NULL,
+        completed_on   DATE           NULL,
+        comments       NVARCHAR(MAX)  NULL,
+        current_status NVARCHAR(200)  NULL,
+        category       NVARCHAR(20)   NULL,
+        details_json   NVARCHAR(MAX)  NULL
+    );
+    CREATE INDEX IX_CV_ChargeSummary_run_at   ON dbo.CV_ChargeSummary (run_at);
+    CREATE INDEX IX_CV_ChargeSummary_claim_no ON dbo.CV_ChargeSummary (claim_no);
+END
+GO
+-- Started By of the Run that wrote the row (2026-10-22, EEWA-33): the
+-- signed-in Portal User, or the Windows user for a terminal run. Added to a
+-- table made before then; the bot writes it only once it exists.
+IF COL_LENGTH('dbo.CV_ChargeSummary', 'started_by') IS NULL
+    ALTER TABLE dbo.CV_ChargeSummary ADD started_by NVARCHAR(50) NULL;
+GO
+
+-- Portal Users and their Sign-in history (2026-10-22, EEWA-32; terms in
+-- GLOSSARY.md). Passwords only as PBKDF2-SHA256 hashes with their own salt
+-- (web/users.py) — never in plain. Users are disabled, never deleted.
+IF OBJECT_ID('dbo.CV_PortalUser', 'U') IS NULL
+BEGIN
+    CREATE TABLE dbo.CV_PortalUser (
+        username       NVARCHAR(50)   NOT NULL PRIMARY KEY,  -- lower case
+        display_name   NVARCHAR(100)  NOT NULL,
+        role           NVARCHAR(20)   NOT NULL,  -- Admin / Operator / Viewer
+        pw_hash        CHAR(64)       NOT NULL,  -- hex
+        pw_salt        CHAR(32)       NOT NULL,  -- hex
+        pw_iterations  INT            NOT NULL,
+        must_change    BIT            NOT NULL DEFAULT 0,
+        disabled       BIT            NOT NULL DEFAULT 0,
+        failed_count   INT            NOT NULL DEFAULT 0,
+        locked_until   DATETIME2      NULL,
+        created_at     DATETIME2      NOT NULL,
+        created_by     NVARCHAR(50)   NOT NULL,
+        changed_at     DATETIME2      NOT NULL,
+        CONSTRAINT CK_CV_PortalUser_role
+            CHECK (role IN ('Admin', 'Operator', 'Viewer'))
+    );
+END
+GO
+IF OBJECT_ID('dbo.CV_PortalSignIn', 'U') IS NULL
+BEGIN
+    CREATE TABLE dbo.CV_PortalSignIn (
+        id        INT IDENTITY(1,1) PRIMARY KEY,
+        at        DATETIME2     NOT NULL,
+        username  NVARCHAR(50)  NOT NULL,  -- as typed, for a wrong one
+        event     NVARCHAR(30)  NOT NULL,  -- sign_in, sign_out, wrong_password,
+                                           -- locked, timeout, user_created, ...
+        by_user   NVARCHAR(50)  NULL       -- the Admin, for an Admin change
+    );
+    CREATE INDEX IX_CV_PortalSignIn_at ON dbo.CV_PortalSignIn (at);
+END
+GO
+
+-- So the bot can connect with your Windows login (no password), give that
+-- login read/write here. Uncomment and run once, as an admin (e.g. sa):
+--
+-- CREATE USER [MFILESERVER\EC10980] FOR LOGIN [MFILESERVER\EC10980];
+-- ALTER ROLE db_datareader ADD MEMBER [MFILESERVER\EC10980];
+-- ALTER ROLE db_datawriter ADD MEMBER [MFILESERVER\EC10980];