Write down the tool that was built, not the one that was tabled

Secure Send shipped on 21 August and nothing outside the code caught up. The
roadmap still listed it under Deferred as "tabled", and gave as the reason that
the tools plugin is browser-only by design with get_blueprint and get_models
both empty - which stopped being true in the same day's commits that gave it a
blueprint, a table, a migration chain, a permission and a setting. A reader
following the roadmap would have concluded the feature does not exist.

The generated API docs were fine: api-inventory.json and openapi.json both
carry /api/tools/secrets, so the contract gates did their job. What was missing
was every word written for a person, and that is the half where the security
properties live.

docs/SECURE-SEND.md is the new page. The parts worth having in prose rather
than inferring from the code: that a lost secret is lost to everybody including
an administrator, which is the same property as "a compromised database yields
nothing" seen from the other side; that the 4096-character limit is the entire
server-side enforcement, because a server that cannot read what it holds cannot
have an opinion about content, so raising it turns a password tool into an
unaudited file transfer; that redeeming is a POST because preview prefetch in
chat and mail clients would otherwise spend a one-view secret before the
recipient ever sees it; and that somebody should send a link to themselves
through their own mail or chat client and confirm the key survives after the #
before a real credential goes through it, because a product that rewrites links
can strip the fragment and nothing on this side can help.

securesend_allow_guests was in the database, on a settings page, and in no
document. It is now in CONFIG.md with what it actually does - an unauthenticated
write endpoint, rate limited per address, failing closed - rather than only its
one-line description.

Also corrected along the way: site_base_url was documented as scheme + host
while the code deliberately tolerates a subpath in it, and the bundled plugin
table in PLUGINS.md had no row for tools at all.

Still missing after this: PLUGINS.md has no row for backups either.

CHANGELOG.md

@@ -12,6 +12,30 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- **Secure Send: hand somebody a password without leaving it in a chat
+  window.** A link in Tech Tools that carries one credential, dies when it is
+  opened, and expires on its own if nobody opens it. The secret is encrypted in
+  the sender's browser and the key rides in the URL fragment, which browsers
+  never transmit, so the server stores ciphertext it cannot read and a
+  compromised database yields nothing. Nobody can recover a lost secret either,
+  including an administrator, which is the same property seen from the other
+  side. Redeeming is a POST because chat and mail clients prefetch links to
+  build previews, and a one-view secret consumed by a preview window is a secret
+  the recipient never sees; a GET reports availability only. Expiry defaults to
+  24 hours (maximum a week) and views to one, whichever comes first, and a spent
+  row is deleted. Creating needs a login and `tools.secrets`; reading needs
+  neither, because the recipient usually has no account and the 128-bit token is
+  the authorisation. The 4096-character ciphertext limit is deliberately the
+  whole server-side enforcement: a zero-knowledge server cannot tell a password
+  from a document, so size is the only control it has, and raising it turns this
+  into the file transfer it was scoped not to be. Documented in
+  `docs/SECURE-SEND.md`.
+- **A site can let people without an account create a Secure Send link.**
+  New `securesend_allow_guests` setting (Settings > Tools > Secure Send), off by
+  default because a guest secret has no creator and the audit trail can then say
+  when and from where but never who. Guest creation is rate limited per address
+  and the setting fails closed if it cannot be read, so an error can never be
+  what opens an unauthenticated write endpoint.
 - **The code generator can print a back side.** A badge card is two-sided and
   the generator only ever emitted one page per card. The Back side section
   turns on a second page per card carrying either the same code again, a fixed
@@ -84,6 +108,14 @@ ADR-007 and ADR-002.
 
 ### Changed
 
+- **Tech Tools no longer asks people to sign in for tools that need no
+  account.** `/tools`, `/tools/codes` and `/tools/secure-send` were all behind
+  `requiresAuth`. The label generator runs entirely in the browser - no API, no
+  data, nothing to protect - so gating it only ever cost a guest the use of it,
+  and gating the Secure Send page contradicted the guest setting that lets
+  somebody with no account create a link. The server still decides who may
+  create a secret: making a page reachable is not the same as allowing the
+  action, and the two were conflated.
 - **Settings on the left, labels on the right.** The controls were a narrow
   column with the preview trailing underneath, so the labels being adjusted were
   off the bottom of the screen. The preview is now a column of its own that