Apply skill-driven review fixes: security, hook isolation, tests, docs

Addresses findings from a 6-lens review against the project skills
(defining-asset-contract, enforcing-plugin-contract, hardening-flask-config,
integrating-plugin-hooks, pinning-flask-behavior, simplifying-python).

Security (hardening-flask-config):
- Load per-plugin COLLECTOR_API_KEY_<PLUGIN> from env in create_app. from_object
  only copies class attributes, so per-plugin keys (ADR-006) were dead in real
  deploys and silently fell back to the shared key.
- EMPLOYEE_DB_USER/PASSWORD no longer default to root/rootpassword (no safe
  default for a secret; unset fails loud). Documented in .env.example + DEPLOY.md.
- COLLECTOR_API_KEY + per-plugin + EMPLOYEE_DB_* added to .env.example/DEPLOY.md.

Hook isolation (integrating-plugin-hooks):
- collector _collector_plugins and dashboard get_navigation now re-raise in
  dev/test and log+isolate in prod, instead of silently swallowing a broken
  plugin hook.

Plugin loader (enforcing-plugin-contract):
- enable_plugin/install_plugin read dependencies+version from the manifest
  instead of instantiating the plugin class.
- _register_plugin_components rejects a second plugin claiming an already-used
  api_prefix (reset per app in init_app).

Tests (pinning-flask-behavior):
- test_identifiers.py: gauge/maintenance round-trip on computer/printer/network
  create+update; per-type seed yields the 12 identifier keys.
- contract tests for apply_collector_payload presence + schema-declarers-implement.
- security tests for per-plugin key env loading + no employee-db password default.

Docs/contract sync (defining-asset-contract):
- PLUGIN-HOOKS.md documents apply_collector_payload; stale 0.2.0 -> 0.3.0.
- ADR-006 documents apply_collector_payload + single-dispatch rationale.
- ADR-001 enumerates the expanded shopdb.api import surface.

Simplify (simplifying-python):
- De-duplicate the 21-entry settings defaults: shared build_default_settings()
  used by both the /settings/seed route and the CLI (were drifting copies).
- Remove dead AssetStatus import + redundant AssetType local import in computers
  plugin; comment the statusid=1 collector default.

153 tests pass (was 145), naming/style green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shopdb/cli/__init__.py

@@ -213,165 +213,9 @@ def seed_settings():
     """Seed default system settings."""
     from shopdb.extensions import db
     from shopdb.core.models import Setting
+    from shopdb.core.api.settings import build_default_settings
 
-    defaults = [
-        # Zabbix integration
-        {
-            'key': 'zabbix_enabled',
-            'value': 'false',
-            'valuetype': 'boolean',
-            'category': 'integrations',
-            'description': 'Enable Zabbix integration for printer supply monitoring'
-        },
-        {
-            'key': 'zabbix_url',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'integrations',
-            'description': 'Zabbix API URL (e.g., http://zabbix.example.com:8080)'
-        },
-        {
-            'key': 'zabbix_token',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'integrations',
-            'description': 'Zabbix API authentication token'
-        },
-        # Email/SMTP settings
-        {
-            'key': 'smtp_enabled',
-            'value': 'false',
-            'valuetype': 'boolean',
-            'category': 'email',
-            'description': 'Enable email notifications and alerts'
-        },
-        {
-            'key': 'smtp_host',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'email',
-            'description': 'SMTP server hostname'
-        },
-        {
-            'key': 'smtp_port',
-            'value': '587',
-            'valuetype': 'integer',
-            'category': 'email',
-            'description': 'SMTP server port (usually 587 for TLS, 465 for SSL, 25 for unencrypted)'
-        },
-        {
-            'key': 'smtp_username',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'email',
-            'description': 'SMTP authentication username'
-        },
-        {
-            'key': 'smtp_password',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'email',
-            'description': 'SMTP authentication password'
-        },
-        {
-            'key': 'smtp_use_tls',
-            'value': 'true',
-            'valuetype': 'boolean',
-            'category': 'email',
-            'description': 'Use TLS encryption for SMTP connection'
-        },
-        {
-            'key': 'smtp_from_address',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'email',
-            'description': 'From address for outgoing emails'
-        },
-        {
-            'key': 'smtp_from_name',
-            'value': 'ShopDB',
-            'valuetype': 'string',
-            'category': 'email',
-            'description': 'From name for outgoing emails'
-        },
-        {
-            'key': 'alert_recipients',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'email',
-            'description': 'Default email recipients for alerts (comma-separated)'
-        },
-        # Audit log settings
-        {
-            'key': 'audit_retention_days',
-            'value': '90',
-            'valuetype': 'integer',
-            'category': 'audit',
-            'description': 'Number of days to retain audit logs (0 = keep forever)'
-        },
-        # Authentication settings
-        {
-            'key': 'saml_enabled',
-            'value': 'false',
-            'valuetype': 'boolean',
-            'category': 'auth',
-            'description': 'Enable SAML SSO authentication'
-        },
-        {
-            'key': 'saml_idp_metadata_url',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'auth',
-            'description': 'SAML Identity Provider metadata URL'
-        },
-        {
-            'key': 'saml_entity_id',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'auth',
-            'description': 'SAML Service Provider entity ID (e.g., https://shopdb.example.com)'
-        },
-        {
-            'key': 'saml_acs_url',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'auth',
-            'description': 'SAML Assertion Consumer Service URL'
-        },
-        {
-            'key': 'saml_allow_local_login',
-            'value': 'true',
-            'valuetype': 'boolean',
-            'category': 'auth',
-            'description': 'Allow local username/password login when SAML is enabled'
-        },
-        {
-            'key': 'saml_auto_create_users',
-            'value': 'true',
-            'valuetype': 'boolean',
-            'category': 'auth',
-            'description': 'Automatically create users on first SAML login'
-        },
-        {
-            'key': 'saml_admin_group',
-            'value': '',
-            'valuetype': 'string',
-            'category': 'auth',
-            'description': 'SAML group name that grants admin role'
-        },
-    ]
-
-    # Asset identifier toggles, per identifier AND per asset type (ADR-001).
-    from shopdb.core.api.settings import IDENTIFIER_LABELS, IDENTIFIER_ASSETTYPES
-    for name, label in IDENTIFIER_LABELS.items():
-        for assettype in IDENTIFIER_ASSETTYPES:
-            defaults.append({
-                'key': f'identifier_{name}_{assettype}_enabled',
-                'value': 'true',
-                'valuetype': 'boolean',
-                'category': 'identifiers',
-                'description': f'Show the {label} identifier on {assettype} assets',
-            })
+    defaults = build_default_settings()
 
     created = 0
     for d in defaults: