Tech Tools is reachable by the people it was built for

Every tool on that page is usable without an account, on purpose - the routes
carry no requiresAuth and say so - and Secure Send is the one write this
product offers a guest. The sidebar entry still never appeared for them: it
named no permission, so the filter that decides what a signed-out visitor may
see had nothing to go on and dropped it.

The plugin had no read permission to name, only tools.secrets, so it gains
tools.view: reaching the page at all. The tools themselves run in the browser
and touch no data, which is why this is about whether the entry appears rather
than about what anybody can read.

The item names either right. Somebody granted only Secure Send needs the entry
that leads to it, and a manager who holds neither still does not see it.

CHANGELOG.md

@@ -115,6 +115,14 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **Tech Tools was invisible to anyone without an account**, even though every
+  tool on the page is deliberately usable without one and Secure Send is the
+  single write this product offers a guest. The nav item named no permission,
+  because the plugin had none to name, so the sidebar filter dropped it. The
+  plugin gained `tools.view`, and the item now names either that or
+  `tools.secrets` - somebody granted only Secure Send still needs the entry
+  that leads to it.
+
 - **The sidebar offered pages the reader could not open, and hid ones they
   could.** A nav item is hidden from anybody who does not hold its permission,
   but only four items ever declared one - so the filter did nothing for the