Consolidate settings into 8 hubs and fix security vulnerabilities

Settings Consolidation (37+ pages to 8 hubs):
- Asset Type Hub: Unified type management with plugin descriptors
- Model Catalog Hub: Vendors, types, models, operating systems
- Asset Configuration Hub: Statuses, relationships, fields, identifiers
- Security Hub: Authentication, tokens, users, audit
- Site Configuration Hub: Site settings, floor map, branding, imports
- Integrations Hub: ServiceNow, Zabbix, Dell warranty
- Locations Hub: Locations, business units, employees
- Network Infrastructure Hub: VLANs, subnets

Plugin Descriptor Pattern:
- Add get_asset_type_descriptor hook to BasePlugin
- Implement descriptors in 6 plugins (printers, computers, machines, network, measuringtools, locations)
- Add /api/pluginui/asset-type-descriptors and core-type-descriptors endpoints
- Generic SubtypesTab component renders CRUD UI from descriptor schema

Security Fixes:
- Fix stored XSS via javascript: URIs in Models and Support Teams
- Add URL scheme validation (allow only http/https) in create/update endpoints
- Fix plugin contract violations in endpoints plugin (use shopdb.api imports)
- Add missing requiresAdmin guard to printer model supplies route
- Add user-facing error messages to API token load failures

Integration Improvements:
- Add persistent tab navigation to ServiceNow, Zabbix, and Dell Warranty settings
- Standardize integration settings UI across all three pages
- Fix tab visibility when navigating between integrations

Tested with 94-agent orchestrated review for ADR compliance and security.

plugins/endpoints/api/routes.py

@@ -18,13 +18,13 @@ from flask import Blueprint, request, current_app
 from flask_jwt_extended import current_user
 
 from shopdb.api import (
-    db, Asset, Setting, success_response, error_response, paginated_response,
+    db, Asset, AssetRelationship, Setting, success_response, error_response, paginated_response,
     ErrorCodes, get_pagination_params, paginate_query, require_permission,
     require_role, caller_holds, caller_is_role, mint_service_token,
     list_service_tokens,
     revoke_service_tokens,
     AuditLog, audit_log, collector_authorized, User,
-    Application, AppVersion, Script,
+    Application, AppVersion, Script, send_alert,
 )
 
 from ..models import (
@@ -34,7 +34,6 @@ from ..models import (
 from ..commands import COMMAND_ALLOWLIST, is_allowed_action, ALLOWED_ACTIONS_FOR, row_actions_for, requires_target, action_targetkind, elevated_permission_for, minimum_agent_version_for, action_minimum_versions, parse_agent_version, agent_meets_minimum, PLACE_POLICY_HOLD, ACTIVE_POLICY_HOLDS, HOLDABLE_ACTIONS_FOR, RELEASE_POLICY_HOLD, ACTIVE_LOCK_FOR, PLACE_ENDPOINT_LOCK, RELEASE_ENDPOINT_LOCK
 from . import agentstore
 from ..eventcatalog import CRITICAL_EVENT_IDS, event_severity, event_title
-from shopdb.api import send_alert
 from markupsafe import escape
 
 endpoints_bp = Blueprint('endpoints', __name__)
@@ -3451,22 +3450,10 @@ def _purge_expired_operator_reports():
 def _send_operator_report_alert(report, asset_id, hostname):
     """Send email alert for new operator issue report to default alert recipients."""
     from flask import url_for, request
-    from shopdb.utils.mailer import get_smtp_config, _normalize_recipients
-    from shopdb.core.models.relationship import AssetRelationship
 
     current_app.logger.info('_send_operator_report_alert called for report %d, asset %d, hostname %s',
                             report.operatorreportid, asset_id, hostname)
 
-    # Check if we have recipients before doing expensive work
-    config = get_smtp_config()
-    current_app.logger.info('SMTP config: enabled=%s, host=%s, alert_recipients=%s',
-                            config.get('enabled'), config.get('host'), config.get('alert_recipients'))
-    recipients = _normalize_recipients(config['alert_recipients'])
-    if not recipients:
-        current_app.logger.warning('Skipping operator report alert: no alert recipients configured')
-        return
-    current_app.logger.info('Will send alert to %d recipient(s): %s', len(recipients), recipients)
-
     asset = Asset.query.get(asset_id)
     if not asset:
         current_app.logger.warning('Cannot send operator report alert: asset %d not found', asset_id)