Build an equipment checkout board with Django and Postgres

[sdairs]

What changes

Adds a small Django equipment checkout board backed by ClickHouse Managed Postgres. Members borrow and return equipment with native Django authentication and CSRF protection; staff manage inventory in Django admin. Item-first transactions coordinate borrowing, inventory changes, and returns, while a partial unique constraint enforces one active loan per item. Returns preserve history and are idempotent.

Includes pinned Python dependencies, migrations, separate migration/runtime database roles, a seeded UI, explicit Cloud setup and cleanup instructions, and a CI configuration check. The companion article remains local for editorial review.

Validation

• Fresh Linux VM install and migration from an empty, real Cloud Postgres 18.6 service; board migration reversed and reapplied successfully.
• 13 live HTTP/database tests passed, including simultaneous checkout, direct uniqueness rejection, return timestamp validation, member/staff authorization, CSRF, native admin validation, disabling inventory during checkout, restricted role permissions, and certificate-specific wrong-CA/wrong-hostname failures.
• Chromium browser login, actual htmx borrow/return, desktop/mobile screenshots, and overflow checks passed.
• A real server process restart preserved the same session, active loan and timestamp; a cookie-restoration bug in the test helper was corrected before its final pass.
• Second clean Linux environment installed the committed pins and passed Django system checks and Python compilation. Django model migration drift check passed.
• The dedicated Cloud test service was deleted and its exact ID confirmed absent. No Cloud credentials or private evidence are committed.

This is a localhost development example. The README describes HTTPS, secure cookies, static file serving and login rate limiting for hosted operation. Hosted app deployment, HA/failover and throughput testing are outside this change.

Browser-helper follow-up: Python Playwright is now pinned to 1.56.0. Only helper requirement pins changed; runtime application code/dependencies are unchanged. Clean isolated native-Linux installs, pip check and Chromium launch/DOM/screenshot smoke passed for the updated helper. Full Cloud/application acceptance remains recorded at 38e11ded0719c8559f73c2e1a52e4a24f4b8daed; it was not rerun for this test-dependency-only follow-up.