Act on the wj architectural review: races, limits, pool and contract gaps

Findings F2, F4, F5, F6, F7, F8, F9, F10, F11 and F13 from
wj-architectural-review.md. F1/F1a (the non-sargable LOWER pattern) and F3
(the warranty sync holding a pooled connection) are being handled separately
and are untouched here.

- A collector check-in that raced another for the same PC lost everything:
  the unique index on the application fingerprint raised, nothing caught it,
  and the whole check-in rolled back, discarding state, events and hardware,
  answering the agent with form copy meant for a person. The insert now runs
  in a savepoint, reconciles what the other transaction already wrote, one row
  per savepoint so a second collision skips a row rather than the batch, and
  the check-in commits with a warning. This is the shape the delete side of
  the same function already had.
- Enrollment is deliberately unauthenticated, so it now carries a per-address
  rate limit and a cap on pending requests, and the cap is a setting an admin
  can see and change. A flood can no longer bury the approval queue or grow
  the table without bound.
- The fleet alert poll no longer formats debug strings on every request.
- BusinessUnit is on the contract surface (0.34.0), so the endpoints plugin
  stops reaching into a core table with raw SQL.
- A test walks every asset type descriptor and proves the endpoint it names
  really refuses a caller without the declared permission.
- The plugin settings routes now need a permission; they were telling anyone
  which modules a site runs and where its components live.
- The connection pool is sized explicitly with a short timeout, and the
  arithmetic against the server's connection ceiling is written next to the
  worker count instead of being left to defaults nobody chose.
- Fleet alerts carry both the correct lowercase keys and the old camelCase
  pair. Trays older than 1.7.0 match keys case-sensitively and would have gone
  quiet on every PC not yet upgraded; the old pair goes when they are.
- The dev server proxy points at localhost again, with environment variables
  for the remote-box workflow, and one developer's address is out of the
  server certificate page.

CONTRIBUTING.md

@@ -156,6 +156,43 @@ When creating a new plugin:
 
 See the PLUGIN-QUICKSTART wiki page (when published) for the 30-minute walkthrough.
 
+#### A plugin must not hold a DB session across external I/O
+
+Rule: finish with the database before you call anything outside the process -
+an HTTP API (Dell warranty, ServiceNow, Zabbix, Azure/Intune), a subprocess, a
+file on a network share - and open a fresh session afterwards to write the
+result.
+
+Why it is a rule and not a preference. The app runs gevent workers, so a
+request that blocks on a network call does not block its worker, and the call
+can take minutes without anything complaining. What it DOES hold for those
+minutes is a pooled database connection. Each worker owns a pool of
+`DB_POOL_SIZE + DB_MAX_OVERFLOW` connections (see `shopdb/config.py` and the
+arithmetic beside `--workers` in `docker-compose.yml`), and hundreds of
+greenlets can enter the same slow path at once. Drain the pool and every other
+request in that worker blocks on checkout and then fails - the whole site,
+every plugin, while the CPU sits idle and MySQL reports itself healthy. That is
+the worst diagnostic signature there is.
+
+The shape to write:
+
+```python
+# Read what you need, then let the session go.
+servicetags = [row.servicetag for row in query.all()]
+db.session.remove()
+
+results = provider.bulk_lookup(servicetags)   # slow, no connection held
+
+for servicetag, result in results.items():    # new session, short write
+    ...
+db.session.commit()
+```
+
+Rules of thumb: no `requests`, `urllib`, `subprocess` or network-share access
+between a query and its `commit()`; cap every external call with a timeout; and
+if a sync is inherently long, chunk it so each chunk is its own
+read / call / write cycle.
+
 ## Testing
 
 Run tests with: