Add personal API tokens; wire measuring tools into remaining surfaces

API tokens: any user mints named, optionally-expiring tokens
(shopdb_pat_..., sha256-stored, secret shown once) at Settings > API
Tokens; a before-request shim swaps a valid PAT for a request-scoped
JWT of its owner, so the entire existing auth/authz/import-mode stack
works unchanged and revoked/expired tokens 401 cleanly. Built for
long-running scripts - the legacy import no longer dies when a login
JWT expires. Migration 7d21_apitokens; create/revoke audit-logged.

Audited integration gaps fixed: Asset.to_dict serializes measuring
tools (typedata + pluginid - relationship links to tools resolve); map
subtype filter/colors and MapEditor include them; dashboard totals
count them; warranty links use a new by-asset route; the measuringtools
ADR-010 hooks are real (corrected presentation token, implemented
map-overlay endpoint); the login avatar resolves through the
employee-photo helper.

737 tests pass; naming green; frontend builds; both features verified
live end-to-end.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/views/measuringtools/MeasuringToolDetail.vue

@@ -15,9 +15,6 @@
     <template v-else-if="tool">
       <!-- Hero Section -->
       <div class="hero-card">
-        <div class="hero-image" v-if="tool.measuringtool?.imageurl">
-          <img :src="tool.measuringtool.imageurl" alt="Model photo" />
-        </div>
         <div class="hero-content">
           <div class="hero-title">
             <h1>{{ tool.assetnumber }}</h1>
@@ -188,7 +185,11 @@ function formatDateTime(d) { if (!d) return '-'; return new Date(d).toLocaleStri
 
 onMounted(async () => {
   try {
-    const response = await measuringtoolsApi.get(route.params.id)
+    // by-asset route resolves the tool from a core asset id (search/cross-link
+    // rows carry assetid, not the extension id); detail route keys on the id.
+    const response = route.params.assetid
+      ? await measuringtoolsApi.getByAsset(route.params.assetid)
+      : await measuringtoolsApi.get(route.params.id)
     tool.value = response.data.data
   } catch (err) {
     console.error('Error loading measuring tool:', err)