harden CSV import reconciliation and preserve saved model selections

Default fuzzy reconcile threshold to 0 and refuse merges when digit runs differ so numbered labels like Bay 311 never bind to Bay 310. Keep edit forms from clearing saved model fields when category filtering hides untyped rows. Includes in-progress computers policy and endpoints command feature work.

shopdb/api/__init__.py

@@ -75,8 +75,28 @@ from shopdb.utils.authz import require_permission, require_role
 # internals.
 from shopdb.utils.apitoken_auth import (
     service_token_authorized, authorized_service_token,
+    mint_service_token, list_service_tokens, revoke_service_tokens,
 )
 
+# Collector-token authorization for agent-facing plugin routes that live outside
+# the generic collector blueprint (e.g. the endpoints command claim/result
+# callbacks). Reuses the same per-plugin collector key + managed-token check the
+# ingest route uses, so a plugin never imports core collector internals.
+def collector_authorized(pluginname: str):
+    """Authorize an agent-facing route on a plugin's collector token.
+
+    Returns None when the caller presented a valid collector credential for
+    this plugin (the per-plugin env key or a collector.ingest[.<plugin>]-scoped
+    managed token), else the error_response to return. Lets a plugin gate an
+    agent callback on the same key and kill switch as its ingest route without
+    reaching into core collector internals.
+
+    Imported lazily: shopdb.core.api imports back into shopdb.api (send_upload),
+    so a module-level import here would be a circular import at load time.
+    """
+    from shopdb.core.api.collector import _check_collector_auth, _plugin_api_key
+    return _check_collector_auth(_plugin_api_key(pluginname), pluginname)
+
 # Serving an uploaded file safely. A plugin that serves user-supplied bytes must
 # not have to remember the headers that keep an SVG or an HTML file from running
 # as script in this origin - see shopdb/utils/uploads.py.
@@ -313,6 +333,10 @@ __all__ = [
     'require_role',
     'service_token_authorized',
     'authorized_service_token',
+    'mint_service_token',
+    'list_service_tokens',
+    'revoke_service_tokens',
+    'collector_authorized',
     'SupportTeam',
     # Serving uploads
     'send_upload',