Remove discipline from WP types; prep for firewall hosting + feedback collection

WP type discipline removal:
- SOP WP Types step now has Enabled / Special Rules-Notes / WO Complete
  Approval columns (discipline column and DISCIPLINES/type-discipline maps gone)
- WP Creator: drop the derived Discipline field, the type-trade number code,
  and discipline from saved packages and output; number tokens are now generic
- Default WP number format no longer includes [Discipline]
- Harden buildConstraints against object-shaped constraint names

Firewall hosting:
- Remove external Google Fonts @import; fall back to system fonts (no
  outbound calls, runs fully behind a firewall)

Feedback collection:
- Add shared feedback-config.js with a single FEEDBACK_ENDPOINT hook +
  best-effort postFeedback() (backend or Power Automate/SharePoint)
- Add Export / Import to home and SOP feedback; wire central-post on all three
  surfaces (home, SOP step comments, WP review comments)
- Add DEPLOYMENT.md documenting hosting and both feedback paths

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DEPLOYMENT.md

@@ -0,0 +1,114 @@
+# Deployment & Feedback Collection
+
+The Work Package Suite is a **static client-side app** — plain HTML, CSS, and
+JavaScript. There is no build step and no database.
+
+## Hosting it behind the firewall
+
+Copy the whole folder to any internal web server and serve it over HTTP(S):
+
+- **IIS / Apache / nginx** — drop the files in the site root. `index.html` is the
+  entry point.
+- **SharePoint / network share** — works too, as long as the files are served
+  over `http(s)://` (not opened as `file://...`). Serving over HTTP makes
+  `localStorage` and the embedded Work Package Creator (an `<iframe>`) behave
+  reliably.
+
+The app makes **no outbound internet calls** — the logo and all scripts are
+local, and the previous Google-Fonts dependency has been removed (fonts now fall
+back to system UI fonts). So it runs fully air-gapped behind a corporate
+firewall.
+
+## Where data lives
+
+By default **everything is stored in each user's own browser** (`localStorage`):
+the SOP configuration, the saved Work Packages, the usage logs, and all feedback
+/ comments. This means:
+
+- Data is **per-user and per-device** — it is not shared between people, and
+  clearing browser data erases it.
+- Nothing is transmitted anywhere unless you enable central collection (below).
+
+## Feedback collection
+
+There are two layers, and they work together.
+
+### 1. Export / Import (no server required — works today)
+
+Every feedback surface has **Export** and **Import** buttons:
+
+- Home page → *Leave Feedback* panel
+- SOP Configuration → *Step Comments* (header button)
+- Work Package Creator → *Comments* drawer
+
+A reviewer clicks **Export** to download a JSON file and sends it to you; you
+click **Import** on your machine to merge everyone's feedback together (imports
+de-duplicate, so re-importing is safe). This needs zero infrastructure and works
+behind any firewall.
+
+### 2. Central auto-collection (optional — flip on when hosting is known)
+
+To also gather every submission automatically into one place, set a single value
+in [`feedback-config.js`](feedback-config.js):
+
+```js
+window.FEEDBACK_ENDPOINT = 'https://your-endpoint-url';
+```
+
+When set, each submission is additionally `POST`ed as JSON to that URL (saving
+locally still happens, so a failed/disabled endpoint never loses feedback). The
+endpoint can be either of:
+
+#### Option A — a small backend on your host
+Any server that can run code and append the request body to a file you can
+download. Example (Node/Express):
+
+```js
+const express = require('express');
+const fs = require('fs');
+const app = express();
+app.use(express.json());
+app.post('/feedback', (req, res) => {
+  fs.appendFileSync('feedback.jsonl', JSON.stringify(req.body) + '\n');
+  res.sendStatus(204);
+});
+app.listen(8080);
+```
+
+Each line of `feedback.jsonl` is one submission; download it anytime. (PHP/
+Python/ASP.NET equivalents are a few lines too.)
+
+#### Option B — Microsoft Power Automate → SharePoint / Excel (good fit for M365)
+1. Create a flow with the **"When an HTTP request is received"** trigger.
+2. Paste its generated URL into `FEEDBACK_ENDPOINT`.
+3. Add an action: **Add a row into a table** (Excel) or **Create item**
+   (SharePoint list), mapping the JSON fields (`type`, `name`/`author`, `text`,
+   `submittedAt`, `page`, …).
+
+The "downloadable file" is then just the Excel/SharePoint list, viewable live or
+exported — all inside your corporate cloud.
+
+### CORS note
+If the endpoint is on a **different origin** than the site, it must return CORS
+headers allowing the site's origin (e.g.
+`Access-Control-Allow-Origin: https://wp-suite.yourcompany.local`). A Power
+Automate HTTP trigger and a same-host backend both handle this cleanly; a
+same-origin backend needs no CORS at all.
+
+## Feedback payload shape
+
+Each POST body looks like:
+
+```json
+{
+  "app": "Work Package Suite",
+  "page": "/work-package-suite.html",
+  "submittedAt": "2026-06-15T18:20:00.000Z",
+  "type": "sop_step_comment",
+  "name": "J. Park",
+  "text": "Consider adding a fiber WP type",
+  "step": 4
+}
+```
+
+`type` is one of `home_feedback`, `sop_step_comment`, or `wp_review_comment`.