Add personal API tokens; wire measuring tools into remaining surfaces

API tokens: any user mints named, optionally-expiring tokens
(shopdb_pat_..., sha256-stored, secret shown once) at Settings > API
Tokens; a before-request shim swaps a valid PAT for a request-scoped
JWT of its owner, so the entire existing auth/authz/import-mode stack
works unchanged and revoked/expired tokens 401 cleanly. Built for
long-running scripts - the legacy import no longer dies when a login
JWT expires. Migration 7d21_apitokens; create/revoke audit-logged.

Audited integration gaps fixed: Asset.to_dict serializes measuring
tools (typedata + pluginid - relationship links to tools resolve); map
subtype filter/colors and MapEditor include them; dashboard totals
count them; warranty links use a new by-asset route; the measuringtools
ADR-010 hooks are real (corrected presentation token, implemented
map-overlay endpoint); the login avatar resolves through the
employee-photo helper.

737 tests pass; naming green; frontend builds; both features verified
live end-to-end.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shopdb/core/models/asset.py

@@ -234,6 +234,8 @@ class Asset(BaseModel, SoftDeleteMixin, AuditMixin):
             result['pluginid'] = self.network_device.networkdeviceid
         elif hasattr(self, 'printer') and self.printer:
             result['pluginid'] = self.printer.printerid
+        elif hasattr(self, 'measuringtool') and self.measuringtool:
+            result['pluginid'] = self.measuringtool.measuringtoolid
 
         # Include inherited location if this asset has no location data
         if include_inherited_location:
@@ -271,4 +273,7 @@ class Asset(BaseModel, SoftDeleteMixin, AuditMixin):
         # Check for printer extension
         if hasattr(self, 'printer') and self.printer:
             return self.printer.to_dict()
+        # Check for measuring-tool extension
+        if hasattr(self, 'measuringtool') and self.measuringtool:
+            return self.measuringtool.to_dict()
         return None