Add personal API tokens; wire measuring tools into remaining surfaces

API tokens: any user mints named, optionally-expiring tokens
(shopdb_pat_..., sha256-stored, secret shown once) at Settings > API
Tokens; a before-request shim swaps a valid PAT for a request-scoped
JWT of its owner, so the entire existing auth/authz/import-mode stack
works unchanged and revoked/expired tokens 401 cleanly. Built for
long-running scripts - the legacy import no longer dies when a login
JWT expires. Migration 7d21_apitokens; create/revoke audit-logged.

Audited integration gaps fixed: Asset.to_dict serializes measuring
tools (typedata + pluginid - relationship links to tools resolve); map
subtype filter/colors and MapEditor include them; dashboard totals
count them; warranty links use a new by-asset route; the measuringtools
ADR-010 hooks are real (corrected presentation token, implemented
map-overlay endpoint); the login avatar resolves through the
employee-photo helper.

737 tests pass; naming green; frontend builds; both features verified
live end-to-end.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/components/ShopFloorMap.vue

@@ -132,7 +132,9 @@ const assetTypeColorsMap = {
   'computer': '#2196F3',        // Blue
   'printer': '#4CAF50',         // Green
   'network device': '#FF9800',  // Orange
-  'network_device': '#FF9800'   // Orange (alternate key)
+  'network_device': '#FF9800',  // Orange (alternate key)
+  'measuring_tool': '#9C27B0',  // Purple
+  'measuring tool': '#9C27B0'   // Purple (normalized key)
 }
 
 // Get asset type color with case-insensitive lookup
@@ -229,6 +231,7 @@ function getSubtypeId(asset) {
   if (typeLower === 'computer') return asset.typedata.computertypeid
   if (typeLower === 'network device') return asset.typedata.networkdevicetypeid
   if (typeLower === 'printer') return asset.typedata.printertypeid
+  if (typeLower === 'measuring tool') return asset.typedata.measuringtooltypeid
   return null
 }