[Bounty $400] security: seven more plugins — 39 /tools/* routes trust body uid and act with stored third-party credentials

Summary

The uid-as-auth defect (zapier #14428, mentor #13685, slack/clickup/twitter #14446, twitter-chat-tools #14451, whoop #14453) exists in five more plugin apps — every /tools/* route takes uid from the JSON body and acts with that user's stored OAuth token/API credentials, no caller authentication:

App	Routes	Exposure
omi-google-calendar-app	6	list/create/get/update/delete events, list calendars
omi-hive-app	5	read projects/tasks, create task, update status, search
omi-linear-app	6	create/update issues, list/search/get
omi-notion-app	8	search/read/create/update/append pages, query databases
omi-shopify-app	6	orders/customers/analytics, create order/customer

31 routes total. Anyone with a uid can create calendar events, file Linear issues, write Notion pages, or create Shopify orders/customers under the victim's connected accounts. omi-dropbox-app and omi-github-app are already covered by the #13463 umbrella; these five are not in its file list.

Fix

Per-app <mod>_tools_auth.py shared-secret guard (Authorization: Bearer or <mod>_tools_token query param → <APP>_TOOLS_SECRET env, hmac.compare_digest), applied via Depends() to all 31 routes. Fail-closed 503 unconfigured, 401 bad token. Same mechanism as the merged mentor precedent and #14447/#14452/#14454.

PR with fix + tests follows. cc @kodjima33 @Git-on-my-level