Add 'use main stack settings' toggle for third-party integration credentials

Each of Newbook, Resos, SambaPOS, SMTP, and Nextcloud now has a checkbox at the
top of its credentials block. When enabled, the app reads auth credentials from
the central stack settings service (SETTINGS_URL + STACK_INTERNAL_SECRET) and
the local auth fields are grayed out. App-specific fields (base path, GL codes,
keywords, sync intervals, etc.) remain editable regardless.

Backend: new use_global_* columns on kitchen_settings, migration, global_settings_service
with apply_global_overrides() for in-memory credential injection, GET /api/settings/global-status
endpoint, and apply_global_overrides() called in test-connection endpoints and FileArchivalService.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/services/file_archival_service.py

@@ -31,11 +31,15 @@ class FileArchivalService:
         self.kitchen_id = kitchen_id
 
     async def get_settings(self) -> Optional[KitchenSettings]:
-        """Get kitchen settings"""
+        """Get kitchen settings, with global credential overrides applied in memory."""
         result = await self.db.execute(
             select(KitchenSettings).where(KitchenSettings.kitchen_id == self.kitchen_id)
         )
-        return result.scalar_one_or_none()
+        settings = result.scalar_one_or_none()
+        if settings:
+            from services.global_settings_service import apply_global_overrides
+            await apply_global_overrides(settings)
+        return settings
 
     async def is_ready_for_archival(self, invoice: Invoice) -> bool:
         """

backend/services/global_settings_service.py

@@ -0,0 +1,97 @@
+"""
+Fetch integration credentials from the central stack settings service.
+
+When a kitchen setting has use_global_<slug>=True, the backend reads credentials
+from the settings service (SETTINGS_URL) instead of the local kitchen_settings row.
+apply_global_overrides() modifies the KitchenSettings object IN MEMORY only — it does
+not commit anything to the DB.
+"""
+import os
+import logging
+import httpx
+
+logger = logging.getLogger(__name__)
+
+SETTINGS_URL = os.getenv("SETTINGS_URL", "").rstrip("/")
+STACK_INTERNAL_SECRET = os.getenv("STACK_INTERNAL_SECRET", "")
+
+
+async def get_global_integration(slug: str) -> dict | None:
+    """Fetch unmasked credentials for an integration from the central settings service."""
+    if not SETTINGS_URL or not STACK_INTERNAL_SECRET:
+        return None
+    try:
+        async with httpx.AsyncClient(timeout=5.0) as client:
+            resp = await client.get(
+                f"{SETTINGS_URL}/api/internal/integration/{slug}",
+                headers={"Authorization": f"Bearer {STACK_INTERNAL_SECRET}"},
+            )
+            if resp.status_code == 200:
+                return resp.json()
+            logger.warning("Global settings fetch for %s returned %s", slug, resp.status_code)
+    except Exception as exc:
+        logger.warning("Global settings fetch for %s failed: %s", slug, exc)
+    return None
+
+
+async def check_global_status() -> dict[str, bool]:
+    """Return whether each integration is configured in the central settings service."""
+    # slug → list of secret fields that must be non-empty to count as "configured"
+    required = {
+        "smtp": ["pass"],
+        "nextcloud": ["password"],
+        "newbook": ["api_key"],
+        "resos": ["api_key"],
+        "sambapos": ["password"],
+    }
+    results: dict[str, bool] = {}
+    for slug, fields in required.items():
+        creds = await get_global_integration(slug)
+        results[slug] = bool(creds and all(creds.get(f) for f in fields))
+    return results
+
+
+async def apply_global_overrides(settings) -> None:
+    """
+    In-memory only: override credential fields on a KitchenSettings instance
+    where the corresponding use_global_* flag is True.
+
+    Attribute assignments do NOT persist to the DB — the session is never committed
+    as a result of this call.
+    """
+    if getattr(settings, "use_global_smtp", False):
+        creds = await get_global_integration("smtp")
+        if creds:
+            settings.smtp_host = creds.get("host") or settings.smtp_host
+            settings.smtp_port = int(creds.get("port") or settings.smtp_port or 587)
+            settings.smtp_username = creds.get("user") or settings.smtp_username
+            settings.smtp_password = creds.get("pass") or settings.smtp_password
+
+    if getattr(settings, "use_global_nextcloud", False):
+        creds = await get_global_integration("nextcloud")
+        if creds:
+            settings.nextcloud_host = creds.get("base_url") or settings.nextcloud_host
+            settings.nextcloud_username = creds.get("username") or settings.nextcloud_username
+            settings.nextcloud_password = creds.get("password") or settings.nextcloud_password
+
+    if getattr(settings, "use_global_newbook", False):
+        creds = await get_global_integration("newbook")
+        if creds:
+            settings.newbook_api_username = creds.get("username") or settings.newbook_api_username
+            settings.newbook_api_password = creds.get("password") or settings.newbook_api_password
+            settings.newbook_api_key = creds.get("api_key") or settings.newbook_api_key
+            settings.newbook_api_region = creds.get("region") or settings.newbook_api_region
+
+    if getattr(settings, "use_global_resos", False):
+        creds = await get_global_integration("resos")
+        if creds:
+            settings.resos_api_key = creds.get("api_key") or settings.resos_api_key
+
+    if getattr(settings, "use_global_sambapos", False):
+        creds = await get_global_integration("sambapos")
+        if creds:
+            settings.sambapos_db_host = creds.get("host") or settings.sambapos_db_host
+            settings.sambapos_db_port = creds.get("port") or settings.sambapos_db_port
+            settings.sambapos_db_name = creds.get("database") or settings.sambapos_db_name
+            settings.sambapos_db_username = creds.get("username") or settings.sambapos_db_username
+            settings.sambapos_db_password = creds.get("password") or settings.sambapos_db_password