Add email sending (service + 3 flows) and a general asset label generator

Email: a stdlib SMTP mailer (settings-first config, graceful no-op when
unconfigured), a test-email endpoint wired to the Email settings page,
forced first-login password change (users.mustchangepassword, migration
7d23, /change-password flow), new-user welcome mail, and on-demand
report/alert delivery (POST /api/reports/email + Email Report buttons)
with an external-cron-with-a-scoped-PAT path documented for automation.
All tests patch smtplib - no network.

Labels: a shared /print/asset-label/<type>/<id> view any asset detail
page opens - card or plain style, QR or barcode, configurable encoding.
Per-type qr_target_* templates plus label_default_style/codetype/encodes
settings on the Printing page. Measuring-tool labels default to encoding
their inspection-operation code (derived from the location name, e.g.
0615), so every tool in an area shares the area code - verified by
decoding the rendered QR. Machine labels default to the machine number;
blank-serial handled gracefully.

808 tests pass; both features verified live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_plugins/test_measuringtools.py

@@ -202,6 +202,35 @@ def test_tool_create_and_get_merged(client, auth_headers):
     assert fetched.get_json()['data']['measuringtool']['measuringtoolid'] == tool_id
 
 
+def test_tool_payload_carries_location_code_and_name(mt_app, client, auth_headers):
+    """A tool at an operation location exposes locationcode (leading token)
+    and locationname so a printed label can encode the inspection operation."""
+    with mt_app.app_context():
+        from shopdb.core.models import Location
+        location = Location(locationname='0615 Blisk Inspection')
+        _db.session.add(location)
+        _db.session.commit()
+        location_id = location.locationid
+
+    created = client.post('/api/measuringtools', headers=auth_headers, json={
+        'assetnumber': 'MT-LOC-1', 'statusid': _status_id(client),
+        'locationid': location_id,
+    })
+    assert created.status_code == 201, created.get_json()
+    payload = created.get_json()['data']
+    assert payload['locationname'] == '0615 Blisk Inspection'
+    assert payload['locationcode'] == '0615'
+
+
+def test_tool_payload_location_code_none_when_unplaced(client, auth_headers):
+    """A tool with no location degrades gracefully: locationcode is None."""
+    created = client.post('/api/measuringtools', headers=auth_headers, json={
+        'assetnumber': 'MT-NOLOC-1', 'statusid': _status_id(client),
+    })
+    assert created.status_code == 201, created.get_json()
+    assert created.get_json()['data']['locationcode'] is None
+
+
 def test_tool_update_merged_payload(client, auth_headers):
     created = client.post('/api/measuringtools', headers=auth_headers, json={
         'assetnumber': 'MT-UPD-1', 'statusid': _status_id(client),