Security: mask settings secrets, remove hardcoded employee-DB creds

- GET /settings now masks password/token values (were returned in plaintext
  to anonymous callers); sending the mask back on update is a no-op so the
  real secret is never clobbered.
- Move the employee-directory DB credentials out of source into env-backed
  config (shopdb.utils.employee_db); employees + notification recognition use
  the shared helper. Employee lookups stop leaking exception strings.
- Fix low-supplies report using loc.location instead of loc.locationname.

Employee/notification read endpoints stay unauthenticated by design (public
shopfloor kiosk displays consume them).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shopdb/core/api/settings.py

@@ -13,6 +13,22 @@ settings_bp = Blueprint('settings', __name__)
 SETTINGS_CACHE_KEY = 'system_settings'
 SETTINGS_CACHE_TTL = 300  # 5 minutes
 
+# Placeholder returned in API responses for secret values so they are never
+# exposed in plaintext. Sending it back on update is treated as "unchanged".
+SECRET_MASK = '********'
+
+
+def _is_secret(key: str) -> bool:
+    return 'password' in key or 'token' in key or 'secret' in key
+
+
+def _serialize_setting(setting):
+    """Serialize a setting, masking secret values so they never leave the API."""
+    data = setting.to_dict()
+    if _is_secret(setting.key):
+        data['value'] = SECRET_MASK if setting.value else ''
+    return data
+
 
 def get_cached_settings():
     """Get all settings from cache or database."""
@@ -42,7 +58,7 @@ def list_settings():
         query = query.filter_by(category=category)
 
     settings = query.order_by(Setting.category, Setting.key).all()
-    return success_response([s.to_dict() for s in settings])
+    return success_response([_serialize_setting(s) for s in settings])
 
 
 @settings_bp.route('/<key>', methods=['GET'])
@@ -54,7 +70,7 @@ def get_setting(key: str):
     if not setting:
         return error_response(ErrorCodes.NOT_FOUND, f'Setting {key} not found', http_code=404)
 
-    return success_response(setting.to_dict())
+    return success_response(_serialize_setting(setting))
 
 
 @settings_bp.route('/<key>', methods=['PUT'])
@@ -74,15 +90,21 @@ def update_setting(key: str):
     # Track old value for audit
     old_value = setting.value
 
-    # Convert value to string for storage
     value = data['value']
+
+    # A secret submitted as the mask placeholder means "leave unchanged" - the
+    # client only ever received the mask, so don't overwrite the real secret.
+    if _is_secret(key) and value == SECRET_MASK:
+        return success_response(_serialize_setting(setting), message='Setting unchanged')
+
+    # Convert value to string for storage
     if isinstance(value, bool):
         setting.value = 'true' if value else 'false'
     else:
         setting.value = str(value) if value is not None else None
 
     # Audit log (mask sensitive values)
-    is_sensitive = 'password' in key or 'token' in key or 'secret' in key
+    is_sensitive = _is_secret(key)
     AuditLog.log('updated', 'Setting', entityname=key, changes={
         'value': {
             'old': '***' if is_sensitive else old_value,
@@ -93,7 +115,7 @@ def update_setting(key: str):
     db.session.commit()
     invalidate_settings_cache()
 
-    return success_response(setting.to_dict(), message='Setting updated')
+    return success_response(_serialize_setting(setting), message='Setting updated')
 
 
 @settings_bp.route('', methods=['POST'])