Let a site open secure send to guests, and choose how many times a link opens

Two asks, and the first is a real security decision so it is a SETTING that
defaults to the safe answer rather than a code change somebody inherits.

securesend_allow_guests, OFF by default. With it off the model is unchanged: a
login plus tools.secrets. With it on, somebody with no account - at a shared bay
terminal, a contractor - can create a link too.

The cost is named in the setting's own description and pinned by a test: a guest
secret has NO CREATOR, so the audit trail can say when and from where but never
who. That is the whole reason it is a switch a person turns on deliberately.

IT FAILS CLOSED. A missing row, a half-migrated site, an unhappy database - the
answer is no. An error must never be the thing that opens an unauthenticated
write endpoint.

A SIGNED-IN USER STILL NEEDS THE PERMISSION even when guests are allowed, which
is surprising enough that a test pins it: opening the door to guests is a
decision about the door, not about revoking what a role holds.

Guest creation is rate limited per address, same shape as the login limiter. Not
a security boundary - a determined person has more addresses - but an open
endpoint should not be an easy place to park data or fill a disk.

VIEWS ARE NOW A NUMBER, 1 to 100, instead of a four-item dropdown. How many
people need a password is the sender's business: a shift handover is not one
colleague on a call. The floor is what matters, not the ceiling - unlimited
views would just be a password on a web page.

Also folded in, from the retention question: nothing removed a secret that
EXPIRED WITHOUT BEING OPENED. The recipient goes on holiday, the link is never
clicked, and the ciphertext sat there for good - not readable, but it made
"nothing lingers" untrue and grew the table in exactly the case where the
feature failed. Any create now sweeps expired rows and a late click tidies its
own, so it stays bounded without a scheduler an air-gapped site would never add.

Two gates caught mistakes on the way: current_user is a LocalProxy and is never
None, so `current_user is None` silently took the signed-in branch for a guest;
and cache was imported straight from shopdb.extensions when it is already on the
shopdb.api contract surface.

1836 tests green.

plugins/tools/frontend/views/SecureSendCreate.vue

@@ -53,12 +53,17 @@
           </label>
           <label class="field">
             <span class="field-label">Can be opened</span>
-            <select v-model.number="views" class="form-control">
-              <option :value="1">Once</option>
-              <option :value="2">Twice</option>
-              <option :value="3">3 times</option>
-              <option :value="5">5 times</option>
-            </select>
+            <input
+              v-model.number="views"
+              type="number"
+              class="form-control"
+              min="1"
+              :max="MAX_VIEWS"
+            />
+            <span class="field-hint">
+              {{ views === 1 ? 'Once, then destroyed' : views + ' times, then destroyed' }}
+              (1 to {{ MAX_VIEWS }})
+            </span>
           </label>
         </div>
 
@@ -99,6 +104,11 @@ import {
 
 const supported = cryptoAvailable()
 
+// Matches the server's ceiling. A free number rather than a dropdown because
+// "how many people need this password" is the sender's business - a shift
+// handover is not the same as one colleague on a call.
+const MAX_VIEWS = 100
+
 const plaintext = ref('')
 const expiryhours = ref(24)
 const views = ref(1)
@@ -205,6 +215,7 @@ function reset() {
 .options { display: flex; gap: 1rem; flex-wrap: wrap; }
 .options .field { flex: 1 1 12rem; }
 .counter { font-size: 0.8125rem; color: var(--text-light); margin: 0 0 0.5rem; }
+.field-hint { display: block; font-size: 0.8125rem; color: var(--text-light); margin-top: 4px; }
 .counter.over { color: var(--warning); font-weight: 600; }
 .control-note { color: var(--warning); font-size: 0.875rem; margin: 8px 0; }
 .control-hint { color: var(--text-light); font-size: 0.8125rem; margin: 8px 0 12px; }