Security: mask settings secrets, remove hardcoded employee-DB creds

- GET /settings now masks password/token values (were returned in plaintext
  to anonymous callers); sending the mask back on update is a no-op so the
  real secret is never clobbered.
- Move the employee-directory DB credentials out of source into env-backed
  config (shopdb.utils.employee_db); employees + notification recognition use
  the shared helper. Employee lookups stop leaking exception strings.
- Fix low-supplies report using loc.location instead of loc.locationname.

Employee/notification read endpoints stay unauthenticated by design (public
shopfloor kiosk displays consume them).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/notifications/api/routes.py

@@ -12,6 +12,7 @@ from shopdb.utils.responses import (
     ErrorCodes
 )
 from shopdb.utils.pagination import get_pagination_params, paginate_query
+from shopdb.utils.employee_db import employee_connection
 
 from ..models import Notification, NotificationType
 
@@ -522,11 +523,7 @@ def get_shopfloor_notifications():
             # Try to get picture from wjf_employees
             if n.employeesso and n.employeesso.isdigit():
                 try:
-                    import pymysql
-                    conn = pymysql.connect(
-                        host='localhost', user='root', password='rootpassword',
-                        database='wjf_employees', cursorclass=pymysql.cursors.DictCursor
-                    )
+                    conn = employee_connection()
                     with conn.cursor() as cur:
                         cur.execute('SELECT Picture FROM employees WHERE SSO = %s', (int(n.employeesso),))
                         emp = cur.fetchone()
@@ -555,11 +552,7 @@ def get_shopfloor_notifications():
                 picture = None
                 if sso.isdigit():
                     try:
-                        import pymysql
-                        conn = pymysql.connect(
-                            host='localhost', user='root', password='rootpassword',
-                            database='wjf_employees', cursorclass=pymysql.cursors.DictCursor
-                        )
+                        conn = employee_connection()
                         with conn.cursor() as cur:
                             cur.execute('SELECT Picture FROM employees WHERE SSO = %s', (int(sso),))
                             emp = cur.fetchone()
@@ -591,11 +584,7 @@ def get_shopfloor_notifications():
                 picture = None
                 if sso.isdigit():
                     try:
-                        import pymysql
-                        conn = pymysql.connect(
-                            host='localhost', user='root', password='rootpassword',
-                            database='wjf_employees', cursorclass=pymysql.cursors.DictCursor
-                        )
+                        conn = employee_connection()
                         with conn.cursor() as cur:
                             cur.execute('SELECT Picture FROM employees WHERE SSO = %s', (int(sso),))
                             emp = cur.fetchone()

plugins/printers/api/asset_routes.py

@@ -565,7 +565,7 @@ def _get_low_supplies_data():
                 from shopdb.core.models import Location
                 loc = Location.query.get(asset.locationid)
                 if loc:
-                    location_name = loc.location
+                    location_name = loc.locationname
 
             results.append({
                 'printerid': printer.printerid,