Enforce plugin contract purity: single import surface via shopdb.api

Plugins were reaching into internal core paths (shopdb.core.models.*,
shopdb.extensions, shopdb.utils.*), coupling them to core's file layout and
violating the ADR-001 contract. Consolidate onto one versioned surface.

- shopdb.api: expand from 2 helpers to the full plugin import surface -
  db, cache; BaseModel, AuditMixin; core models (Asset, AssetType,
  AssetStatus, Vendor, Model, Communication, CommunicationType, Location,
  Setting, AuditLog, Application, AppVersion, OperatingSystem); response +
  pagination helpers; employee_connection. Documented in PLUGIN-HOOKS.md.
- Migrate all 22 plugin source files to import only from shopdb.api (plus
  shopdb.plugins.base for the ABC).
- Drop the printers plugin's legacy MachineType dependency: remove
  _ensure_legacy_machine_types and the seed_supplies machinetypeid lookup
  (Model.machinetypeid is nullable; printers carry type via PrinterType).
- Guard test test_plugins_only_import_contract_surface scans plugin source
  and fails on any core import outside shopdb.api / shopdb.plugins.base.
- Scaffold templates updated so generated plugins are contract-pure.
- Bump __contract_version__ 0.2.0 -> 0.3.0 (additive surface expansion;
  manifests pin <1.0.0 so they still satisfy).

145 tests pass, naming/style green, app factory boots all 6 plugins.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/printers/services/seed_supplies.py

@@ -19,9 +19,7 @@ Key facts encoded here:
 
 import logging
 
-from shopdb.extensions import db
-from shopdb.core.models import Vendor, Model
-from shopdb.core.models.machine import MachineType
+from shopdb.api import db, Vendor, Model
 
 from ..models import ModelSupply
 
@@ -311,9 +309,6 @@ def seedsupplies():
     model that matches a family's keys; if a family matches no existing model,
     creates a canonical model row so its toners are still available.
     """
-    printertype = MachineType.query.filter_by(category='Printer').first()
-    printertypeid = printertype.machinetypeid if printertype else None
-
     models_touched = 0
     supplies_added = 0
 
@@ -322,10 +317,11 @@ def seedsupplies():
         targets = _matching_models(family['matchkeys'], vendor.vendorid)
 
         if not targets:
+            # machinetypeid is a legacy Model column (nullable); printers are
+            # asset-based now and carry their type via PrinterType, not here.
             model = Model(
                 modelnumber=family['canonical'],
                 vendorid=vendor.vendorid,
-                machinetypeid=printertypeid,
             )
             db.session.add(model)
             db.session.flush()

plugins/printers/services/zabbix_service.py

@@ -24,7 +24,7 @@ from typing import Dict, List, Optional
 import requests
 from flask import current_app
 
-from shopdb.extensions import cache
+from shopdb.api import cache
 
 logger = logging.getLogger(__name__)
 
@@ -55,7 +55,7 @@ class ZabbixService:
     @property
     def isenabled(self) -> bool:
         """Whether the integration is switched on."""
-        from shopdb.core.models import Setting
+        from shopdb.api import Setting
         db_enabled = Setting.get('zabbix_enabled')
         if db_enabled is not None:
             return bool(db_enabled)
@@ -66,7 +66,7 @@ class ZabbixService:
         """Enabled, and a URL plus token are present."""
         if not self.isenabled:
             return False
-        from shopdb.core.models import Setting
+        from shopdb.api import Setting
         self._url = Setting.get('zabbix_url') or current_app.config.get('ZABBIX_URL')
         self._token = Setting.get('zabbix_token') or current_app.config.get('ZABBIX_TOKEN')
         return bool(self._url and self._token)