Remediate the 2026-09-03 feature-test findings

plugins/tools/api/routes.py

@@ -39,6 +39,7 @@ from flask_jwt_extended import jwt_required, get_jwt_identity, current_user
 from shopdb.api import (
     db, cache, Setting, client_ip,
     success_response, error_response, ErrorCodes,
+    caller_holds,
 )
 
 from ..models import SecureSecret
@@ -155,7 +156,9 @@ def create_secret():
                 ErrorCodes.VALIDATION_ERROR,
                 'Too many links from this address. Try again shortly.',
                 http_code=429)
-    elif not current_user.haspermission('tools.secrets'):
+    # caller_holds, for the same reason as the endpoints elevated gate: a
+    # scoped token is a narrower caller than the person who minted it.
+    elif not caller_holds('tools.secrets'):
         return error_response(
             ErrorCodes.FORBIDDEN,
             'You do not have permission to create secret links.',