geenforce: resource-scope binding for fetch tokens (0.15.0)

A geenforce.fetch token can now be pinned to specific manifest scopes so a
fleet-wide key (a display's, delivered by DSC or baked into the image) is not a
skeleton key for the whole content store. NULL binding = unrestricted, so every
existing service token keeps working.

Core:
- ApiToken.resourcescopes column + resourcescopelist property (migration
  7d30_apitoken_resourcescopes; NULL = unrestricted).
- apitokens API create/update accept + persist an optional resourcescopes list
  (a resource-name allowlist; not permission-catalog names).
- New contract helper authorized_service_token(scope): same check as
  service_token_authorized but returns the ApiToken so a plugin can read its
  binding. Contract 0.14.0 -> 0.15.0; also export SupportTeam.

GE-Enforce enforcement:
- get_manifest: a bound token requesting a scope outside its allowlist -> 403.
- get_payload: a bound token may only pull a blob its own scope(s) reference
  (service.blob_referenced_by_scopes); anything else -> 404 (no hash probing).
- Decorator stashes the authorized token on g for the route to read.

Also fixes a pre-existing contract-surface violation: the printers/printedparts
alert helpers imported shopdb.core.models / shopdb.extensions directly; now
via shopdb.api (SupportTeam newly exported). Docs: GE-ENFORCE-DISPLAY.md
provisioning note, PLUGIN-HOOKS.md, CLAUDE.md.

9 new resource-binding tests; full suite 1131 passing.

docs/GE-ENFORCE-DISPLAY.md

@@ -1,6 +1,6 @@
 # GE-Enforce: the gea-shopfloor-display scope
 
-Displays are the share-less corner of the fleet. They are Intune/Entra-joined,
+Displays are the share-less corner of the fleet. They are Entra-joined,
 credential-less kiosk PCs that pull their manifest over HTTPS on port 443 and
 authenticate with a read-only service PAT scoped `geenforce.fetch`, sent as
 `X-API-Key`. They have no SMB share mount. The kiosk engine and the kiosk
@@ -8,6 +8,25 @@ browser are baked into the display image, not shipped over HTTPS, so the display
 manifest heals POLICY / CONFIG drift only, never EXEs. It is self-sufficient and
 does not inherit the fleet-wide `common` scope (see below).
 
+## The display fetch token MUST be resource-bound
+
+The same read-only key ships to every display (delivered by DSC, or baked into
+the image), so it must not be a skeleton key for the whole content store. Mint
+the display token bound to just this scope, so a leak cannot pull any other
+scope's manifest or any blob by hash:
+
+```
+POST /api/apitokens
+{ "name": "display fetch", "scopes": ["geenforce.fetch"],
+  "resourcescopes": ["gea-shopfloor-display"] }
+```
+
+With `resourcescopes` set, `GET /manifest?pctype=<other>` returns 403 and
+`GET /payload/<sha>` returns 404 for any blob the display scope does not
+reference. `resourcescopes` NULL (unset) = unrestricted, for back-compat with
+existing service tokens. Rotate by minting a new bound token and revoking the
+old one (deactivate it server-side); DSC re-delivers, or re-image.
+
 There are three display subtypes, selected by `C:\Enrollment\display-type.txt`:
 `Dashboard`, `Lobby`, and `3DPrintRoom`.