Vendor platform-tools: everything this site runs is now in one repo

shared/platform-tools was a git submodule. On this branch it is a plain
directory of tracked files, frozen at ea3616abae30106df283e73a3e2f9e5bb0e6ae90
— the same commit fotografia.andmore.pt pins. Contents are byte-identical to
that tree, verified blob by blob.

The submodule caused every deployment failure this site has had:

  - .gitmodules named no `branch`, so the update fell back to
    refs/remotes/origin/HEAD — a ref a plain server-side clone never writes.
    "Atualizar submódulo" failed with "Unable to find refs/remotes/origin/HEAD
    revision in submodule path".
  - Its URL was http://, which the origin answers with 523.
  - This install is deployed by uploading files, and a submodule is invisible
    to that. The tree moved forward while shared/platform-tools stayed on the
    old pin, config/functions_secrets.php died on a missing compat_secrets.php,
    and the whole site — public pages included — went down.

Each of those was separately fixable. Together they mean a second repository
nobody can see from the deployment path, gating whether the first one boots. A
plain directory deploys like every other file and cannot fall out of step.

The cost is that platform-tools updates no longer arrive by bumping a pin; they
are a copy-over-and-commit. shared/platform-tools/VENDORED.md records the
upstream SHA, the procedure, and which four files differ from upstream in line
endings only (social/*.js, .css, functions_publications.php — CRLF upstream,
normalised to LF here; content otherwise identical).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

shared/platform-tools/compat_secrets.php

@@ -0,0 +1,59 @@
+<?php
+// ─── Short secret-helper names, backed by the shared implementation ──────────
+//
+// fotografia and hub2 each grew their own config/functions_secrets.php with
+// secret_encrypt()/secret_decrypt() in it. Same enc:v1: wire format, but not
+// the same key: fotografia derived it domain-separated ('am-secret|' . key)
+// while hub2 used a plain sha256 of APP_SECRET_KEY. A value written by one was
+// unreadable by the other, and dance and silver had no implementation at all.
+//
+// There is now one implementation, in functions_settings.php. This file only
+// re-exports it under the short names those call sites already use, so a site
+// keeps calling secret_encrypt() and gets the estate-wide behaviour.
+//
+// A site includes this instead of defining its own:
+//     require_once __DIR__ . '/../shared/platform-tools/compat_secrets.php';
+
+require_once __DIR__ . '/functions_settings.php';
+
+if (!defined('SECRET_PREFIX')) {
+    define('SECRET_PREFIX', PLATFORM_SECRET_PREFIX);
+}
+
+if (!function_exists('secret_encrypt')) {
+    function secret_encrypt(string $plain): string {
+        return platform_secret_encrypt($plain);
+    }
+}
+
+if (!function_exists('secret_decrypt')) {
+    function secret_decrypt(?string $stored): string {
+        return platform_secret_decrypt($stored);
+    }
+}
+
+if (!function_exists('secret_is_encrypted')) {
+    function secret_is_encrypted(string $stored): bool {
+        return str_starts_with($stored, PLATFORM_SECRET_PREFIX);
+    }
+}
+
+if (!function_exists('secret_mask')) {
+    function secret_mask(string $plain, string $key = ''): string {
+        return platform_secret_mask($plain, $key);
+    }
+}
+
+// Both spellings existed: fotografia called it secrets_available(), hub2
+// secrets_key_available(). Keep both so neither site's call sites need editing.
+if (!function_exists('secrets_available')) {
+    function secrets_available(): bool {
+        return platform_settings_secret_available();
+    }
+}
+
+if (!function_exists('secrets_key_available')) {
+    function secrets_key_available(): bool {
+        return platform_settings_secret_available();
+    }
+}