Apply skill-driven review fixes: security, hook isolation, tests, docs

Addresses findings from a 6-lens review against the project skills
(defining-asset-contract, enforcing-plugin-contract, hardening-flask-config,
integrating-plugin-hooks, pinning-flask-behavior, simplifying-python).

Security (hardening-flask-config):
- Load per-plugin COLLECTOR_API_KEY_<PLUGIN> from env in create_app. from_object
  only copies class attributes, so per-plugin keys (ADR-006) were dead in real
  deploys and silently fell back to the shared key.
- EMPLOYEE_DB_USER/PASSWORD no longer default to root/rootpassword (no safe
  default for a secret; unset fails loud). Documented in .env.example + DEPLOY.md.
- COLLECTOR_API_KEY + per-plugin + EMPLOYEE_DB_* added to .env.example/DEPLOY.md.

Hook isolation (integrating-plugin-hooks):
- collector _collector_plugins and dashboard get_navigation now re-raise in
  dev/test and log+isolate in prod, instead of silently swallowing a broken
  plugin hook.

Plugin loader (enforcing-plugin-contract):
- enable_plugin/install_plugin read dependencies+version from the manifest
  instead of instantiating the plugin class.
- _register_plugin_components rejects a second plugin claiming an already-used
  api_prefix (reset per app in init_app).

Tests (pinning-flask-behavior):
- test_identifiers.py: gauge/maintenance round-trip on computer/printer/network
  create+update; per-type seed yields the 12 identifier keys.
- contract tests for apply_collector_payload presence + schema-declarers-implement.
- security tests for per-plugin key env loading + no employee-db password default.

Docs/contract sync (defining-asset-contract):
- PLUGIN-HOOKS.md documents apply_collector_payload; stale 0.2.0 -> 0.3.0.
- ADR-006 documents apply_collector_payload + single-dispatch rationale.
- ADR-001 enumerates the expanded shopdb.api import surface.

Simplify (simplifying-python):
- De-duplicate the 21-entry settings defaults: shared build_default_settings()
  used by both the /settings/seed route and the CLI (were drifting copies).
- Remove dead AssetStatus import + redundant AssetType local import in computers
  plugin; comment the statusid=1 collector default.

153 tests pass (was 145), naming/style green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shopdb/plugins/__init__.py

@@ -40,11 +40,18 @@ class PluginManager:
         self.migration_manager: Optional[PluginMigrationManager] = None
         self._app: Optional[Flask] = None
         self._db = None
+        # API prefixes already claimed by a registered plugin blueprint, to
+        # detect two plugins overlapping on the same /api/... namespace.
+        self._registered_prefixes: set = set()
 
     def init_app(self, app: Flask, db) -> None:
         """Initialize plugin manager with Flask app."""
         self._app = app
         self._db = db
+        # Reset per-app so the prefix-uniqueness guard tracks only this app's
+        # registrations (the manager is a process-wide singleton; tests build
+        # multiple apps from it).
+        self._registered_prefixes = set()
 
         # Setup paths
         instance_path = Path(app.instance_path)
@@ -104,11 +111,18 @@ class PluginManager:
         # Register blueprint
         blueprint = plugin.get_blueprint()
         if blueprint:
-            self._app.register_blueprint(
-                blueprint,
-                url_prefix=plugin.meta.api_prefix
-            )
-            logger.debug(f"Registered blueprint: {plugin.meta.api_prefix}")
+            prefix = plugin.meta.api_prefix
+            # Guard against two plugins claiming the same API prefix; Flask only
+            # rejects duplicate blueprint names, not overlapping url_prefixes, so
+            # an overlap would silently shadow routes.
+            if prefix in self._registered_prefixes:
+                raise ValueError(
+                    f"Plugin {plugin.meta.name} api_prefix '{prefix}' is already "
+                    f"claimed by another blueprint"
+                )
+            self._app.register_blueprint(blueprint, url_prefix=prefix)
+            self._registered_prefixes.add(prefix)
+            logger.debug(f"Registered blueprint: {prefix}")
 
         # Register CLI commands
         for cmd in plugin.get_cli_commands():
@@ -160,17 +174,16 @@ class PluginManager:
             logger.warning(f"Plugin {name} is already installed")
             return False
 
-        # Load plugin class
-        plugin_class = self.loader.load_plugin_class(name)
-        if not plugin_class:
+        # Read metadata from the manifest (single source of truth) instead of
+        # instantiating the plugin class just to inspect deps/version.
+        manifest = self.loader.load_manifest(name)
+        if not manifest:
             logger.error(f"Plugin {name} not found")
             return False
-
-        temp_plugin = plugin_class()
-        meta = temp_plugin.meta
+        manifest_version = manifest.get('version')
 
         # Check dependencies
-        for dep in meta.dependencies:
+        for dep in manifest.get('dependencies', []):
             if not self.registry.is_installed(dep):
                 logger.error(
                     f"Plugin {name} requires {dep} to be installed first"
@@ -185,7 +198,7 @@ class PluginManager:
                 return False
 
         # Register plugin
-        self.registry.register(name, meta.version)
+        self.registry.register(name, manifest_version)
 
         # Load the plugin
         plugin = self.loader.load_plugin(name, self._app, self._db)
@@ -193,7 +206,7 @@ class PluginManager:
             self._register_plugin_components(plugin)
             plugin.on_install(self._app)
 
-        logger.info(f"Installed plugin: {name} v{meta.version}")
+        logger.info(f"Installed plugin: {name} v{manifest_version}")
         return True
 
     def uninstall_plugin(self, name: str, remove_data: bool = False) -> bool:
@@ -246,14 +259,14 @@ class PluginManager:
             logger.info(f"Plugin {name} is already enabled")
             return True
 
-        # Check dependencies are enabled
-        plugin_class = self.loader.load_plugin_class(name)
-        if plugin_class:
-            temp = plugin_class()
-            for dep in temp.meta.dependencies:
-                if not self.registry.is_enabled(dep):
-                    logger.error(f"Cannot enable {name}: {dep} is not enabled")
-                    return False
+        # Check dependencies are enabled. Read deps from the manifest, not by
+        # instantiating the plugin class (manifest is the single source of
+        # truth; instantiating fires __init__ side effects unnecessarily).
+        manifest = self.loader.load_manifest(name)
+        for dep in manifest.get('dependencies', []):
+            if not self.registry.is_enabled(dep):
+                logger.error(f"Cannot enable {name}: {dep} is not enabled")
+                return False
 
         self.registry.enable(name)