Security: mask settings secrets, remove hardcoded employee-DB creds

- GET /settings now masks password/token values (were returned in plaintext
  to anonymous callers); sending the mask back on update is a no-op so the
  real secret is never clobbered.
- Move the employee-directory DB credentials out of source into env-backed
  config (shopdb.utils.employee_db); employees + notification recognition use
  the shared helper. Employee lookups stop leaking exception strings.
- Fix low-supplies report using loc.location instead of loc.locationname.

Employee/notification read endpoints stay unauthenticated by design (public
shopfloor kiosk displays consume them).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shopdb/utils/employee_db.py

@@ -0,0 +1,20 @@
+"""Connection helper for the read-only employee directory database.
+
+Credentials are pulled from app config (env-backed, see Config.EMPLOYEE_DB_*),
+never hardcoded. Used by the employee lookup API and the notification
+recognition feature.
+"""
+
+import pymysql
+from flask import current_app
+
+
+def employee_connection():
+    """Open a pymysql connection to the employee directory DB."""
+    return pymysql.connect(
+        host=current_app.config['EMPLOYEE_DB_HOST'],
+        user=current_app.config['EMPLOYEE_DB_USER'],
+        password=current_app.config['EMPLOYEE_DB_PASSWORD'],
+        database=current_app.config['EMPLOYEE_DB_NAME'],
+        cursorclass=pymysql.cursors.DictCursor,
+    )