Move secure send into Tech Tools, where somebody would look for it

9845867 gave it its own plugin because Tech Tools is browser-only and this needs
storage. That was the right reading of the code and the wrong answer for the
person using it: Tech Tools is where you go for a utility, and a tool nobody can
find is a tool nobody uses.

So Tech Tools now has a blueprint, a table and a migration chain where it had
none. Its docstring and manifest say why, because "every tool here runs in the
browser" was load-bearing documentation and is no longer true.

WHAT MOVED
  /api/securesend       -> /api/tools/secrets
  securesend.create     -> tools.secrets
  securesend0001baseline -> tools0001securesend
  PLUGIN_TABLE_OWNERS, EXPECTED_HEAD_REVISION, EXEMPT_ENDPOINTS, the universal
  profile and the api-inventory surface all follow it.

THE OLD "NO BACKEND" TEST IS NARROWED, NOT DELETED. It asserted
get_blueprint() is None, which is the sort of guard that gets removed when it
becomes inconvenient. It now asserts the blueprint serves EXACTLY the three
secret routes, with their methods - so a future tool that quietly grows an
endpoint or a table has to edit this test, and therefore make the decision on
purpose rather than by drift.

Asserting methods rather than paths also pins the detail this design turns on:
redeeming is POST-ONLY. Chat and mail clients prefetch GET urls to build
previews, and a preview that could redeem would consume a one-view secret before
its recipient opened the link. Previously that was a comment; now it fails a
test.

UNINSTALLING THE OLD PLUGIN COULD NOT BE DONE WITH THE PLUGIN TOOLING. `flask
plugin uninstall securesend` loads a plugin before uninstalling it, so a plugin
whose directory has been deleted cannot be removed by the command that manages
plugins - the registry entry had to be edited by hand. Worth fixing separately;
it is the same registry-versus-code divergence the device work hit from the
other side.

MIGRATING A CHAIN THAT HAS ALREADY RUN needs the old table and its version row
dropped first, because the relocated chain has no stamp and tries to create a
table that exists. Only relevant to anyone who installed securesend during the
hour it existed - it did reach the publication repo in 4242028 - and the fix is
DROP TABLE securesendsecrets plus DROP TABLE alembic_version_securesend before
running plugin upgrade-all.

1829 tests green. Still backend only: there are no pages yet, so nothing here is
reachable by a person.

plugins/tools/models/__init__.py

@@ -0,0 +1,10 @@
+"""Tech Tools models.
+
+Most tools run entirely in the browser and own nothing. Secure send is the
+exception: handing somebody a credential needs storage, an expiry and a view
+counter, so this plugin does carry one table.
+"""
+
+from .securesend import SecureSecret
+
+__all__ = ['SecureSecret']

plugins/tools/models/securesend.py

@@ -0,0 +1,77 @@
+"""A secret handed over by link, encrypted before it ever reaches here.
+
+NOT AN ASSET, so this is a standalone table rather than an extension keyed by
+assetid: a shared credential is an event with a short life, not a thing the site
+owns and inventories.
+
+WHAT THIS TABLE CAN AND CANNOT SEE. The AES key lives in the URL fragment, which
+browsers never send to a server, so what is stored is ciphertext and an IV and
+nothing else. Compromising this table yields no secrets. It also means the
+server cannot inspect what it is holding - which is the right trade for a
+credential, and the reason the SIZE limit in the routes carries the whole weight
+of "this is not a document transfer".
+"""
+
+from datetime import datetime, timezone
+
+from shopdb.api import db, BaseModel
+
+
+def _utcnow():
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
+class SecureSecret(BaseModel):
+    """One shared secret: opaque id, ciphertext, and the rules for its life."""
+
+    __tablename__ = 'securesendsecrets'
+
+    secretid = db.Column(db.Integer, primary_key=True)
+
+    # The unguessable half of the link. With no login on the read side this IS
+    # the credential, so it is 128 bits of randomness rendered as hex - never a
+    # sequence, which would be enumerable by anyone who received one link.
+    token = db.Column(db.String(64), unique=True, nullable=False, index=True)
+
+    # Base64 of the AES-GCM ciphertext, and the IV it was sealed with. Opaque
+    # here by design.
+    ciphertext = db.Column(db.Text, nullable=False)
+    iv = db.Column(db.String(64), nullable=False)
+
+    # Both limits apply, whichever comes first.
+    expiresat = db.Column(db.DateTime, nullable=False, index=True)
+    viewsremaining = db.Column(db.Integer, nullable=False, default=1)
+
+    # Who created it. The reader is anonymous by design, so this is the only
+    # person the row can name - and the reason creation requires a login.
+    createdbyuserid = db.Column(
+        db.Integer,
+        db.ForeignKey('users.userid', ondelete='SET NULL'),
+        nullable=True,
+        index=True,
+    )
+
+    # Recorded for the audit trail; the content of what was read is not
+    # recoverable, but that it was read, and when, is.
+    lastviewedat = db.Column(db.DateTime, nullable=True)
+    viewcount = db.Column(db.Integer, nullable=False, default=0)
+
+    def is_expired(self, now=None):
+        return (now or _utcnow()) >= self.expiresat
+
+    def is_spent(self):
+        return self.viewsremaining <= 0
+
+    def to_dict(self):
+        """NEVER includes the ciphertext.
+
+        This is the shape the CREATOR sees back - a receipt. Handing the payload
+        back on create would put the secret in a second place for no reason.
+        """
+        return {
+            'token': self.token,
+            'expiresat': self.expiresat.isoformat() if self.expiresat else None,
+            'viewsremaining': self.viewsremaining,
+            'viewcount': self.viewcount,
+            'createddate': self.createddate.isoformat() if self.createddate else None,
+        }