Setup wizard P2: per-plugin config schema + settings-first creds

- Plugin contract gains get_config_schema(); the plugins list API returns it.
  Employees plugin declares its directory-DB fields (host/name/user + password).
- employee_connection reads host/name/user settings-first (env fallback); the
  password stays env-only.
- Setup wizard Features step renders each enabled plugin's config: non-secret
  fields save to settings; secrets are never stored - the wizard emits .env
  lines to paste. Fixed the plugins-list data path (data.plugins).
- Settings PUT now upserts (creates the row on first write) so plugin-config
  keys can be saved without pre-seeding.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

shopdb/core/api/settings.py

@@ -112,8 +112,11 @@ def update_setting(key: str):
 
     setting = Setting.query.filter_by(key=key).first()
 
+    # Upsert: create the row on first write (e.g. plugin config keys the setup
+    # wizard saves). New keys default to a plugin-scoped string setting.
     if not setting:
-        return error_response(ErrorCodes.NOT_FOUND, f'Setting {key} not found', http_code=404)
+        setting = Setting(key=key, value='', valuetype='string', category='plugin')
+        db.session.add(setting)
 
     # Track old value for audit
     old_value = setting.value