Survive a stale platform-tools instead of 500ing the whole site

Deploying the local-SMTP commit took fitme3070.pt down:

    PHP Warning: require_once(.../shared/platform-tools/compat_secrets.php):
    Failed to open stream: No such file or directory
    in .../config/functions_secrets.php on line 20

config/functions_secrets.php is loaded on every request, so a hard require_once
on a submodule file is a site-wide fatal — public pages included — whenever
shared/platform-tools lags the code that needs it. It lagged: the server is
still on 603ff84, which predates compat_secrets.php, because "Atualizar
submódulo" was itself broken (fixed in 3626080, which the site had to be up to
deploy). A missing file should not be able to close that loop.

Three requires hardened, each to the failure the caller can actually report:

  - config/functions_secrets.php: falls back to plaintext passthrough helpers
    and logs loudly. secrets_available() then returns false, which is exactly
    what the Comunicações page already renders a warning banner for — so
    nothing silently pretends to be encrypted while the site keeps serving.

  - config/functions_queue.php (_flush_email): throws instead of fataling. A
    fatal killed the request outright, so flush_message()'s catch never ran and
    the row sat in 'sending' forever with no explanation. It now lands in
    last_error where the Monitor page shows it.

  - views/sysadmin/comms.php: renders "Submódulo desactualizado" naming the
    missing files, rather than a blank 500 on the page you would open to
    diagnose mail in the first place.

Verified by loading config/functions_secrets.php with no shared/ directory
present: the bootstrap completes, the warning is logged once, secrets_available()
is false, and setting_secret()/setting_or_env() still return usable values.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

config/functions_queue.php

@@ -128,8 +128,21 @@ function _flush_email(array $row): void {
     // the EMAIL_DEV_REDIRECT safety net itself, including the [DEV] subject
     // prefix and the banner naming the original recipient, so that logic no
     // longer lives here.
-    require_once __DIR__ . '/../shared/platform-tools/functions_mail.php';
-    require_once __DIR__ . '/../shared/platform-tools/functions_settings.php';
+    // A bare require_once would be a FATAL when shared/platform-tools lags the
+    // pinned commit (this install is deployed by file upload, so it does lag).
+    // A fatal here kills the whole request; flush_message()'s catch never runs
+    // and the row stays in 'sending' forever with no explanation. Throwing puts
+    // the reason in last_error, where the Monitor page shows it.
+    $_ptRoot = __DIR__ . '/../shared/platform-tools/';
+    foreach (['functions_mail.php', 'functions_settings.php'] as $_ptFile) {
+        if (!is_file($_ptRoot . $_ptFile)) {
+            throw new RuntimeException(
+                "shared/platform-tools/{$_ptFile} em falta — o submódulo está desactualizado. "
+                . 'Actualize-o em Sistema → Actualizações.'
+            );
+        }
+        require_once $_ptRoot . $_ptFile;
+    }
 
     // Settings come from system_settings first, .env second -- the fleet-wide
     // standard. This install stores them there via setting_or_env(); this