Make external tool setup work without API key prerequisites

[FlintSH]

Built-in ShareX, Flameshot, Spectacle, and Bash downloads already include the account upload token, but the new Integrations copy made creating an API key look like a prerequisite. This makes downloading and importing/running a configuration the obvious default.

• Put screenshot tools first in Profile → Uploads and add a prominent Set up a tool shortcut in Integrations.
• Explain that credentials are included, provide import/run guidance, and present named API tokens as optional for custom integrations.
• Collapse manual token controls, add copy, and explain/confirm replacement so existing tools are not disconnected accidentally. Keep pending replacement state when the controls are hidden and offer a GET-only retry after a load failure.
• Keep cross-section links and Back navigation in sync; update setup documentation.

Generator authentication, existing configurations, upload defaults, and scoped API token behavior remain compatible.

Validation: 24 new generator regression cases cover all four tools, authentication without named-token creation, profile ownership/defaults, and signed-out access. Local type-checking, lint, formatting, and the full PostgreSQL-backed suite pass: 390 tests across 36 files, with only the optional real-S3 check skipped. Desktop/mobile browser checks cover all downloads, optional-token setup, navigation/history, copying, delayed replacement, cancel, and failure handling. The initial CI production build, Code Quality, CodeQL, and Docker checks passed. The final retry-recovery commit passes local type-checking, lint, formatting, and browser regressions; CI is rerunning for that commit.

The initial Meticulous run completed 19 replays with 13 screenshot differences. All five representative groups were reviewed: tools-first ordering, revised copy/navigation text, the Integrations shortcut, and collapsed token controls match the intended change. One recorded click missed the relocated profile-expiration control; a direct browser check confirmed it still opens and selects normally. Meticulous reports the intended visual changes for review.

Ready-to-use tool downloads	Mobile

[github-actions]

Flare PR preview: closed

Preview and disposable data removed.

Commit: 4ff9cedde54f

Public, disposable test instance running untrusted PR code. Anyone can view or change its test data. Do not enter passwords you use elsewhere, credentials, or private files.

[alwaysmeticulous]

✅ Meticulous spotted visual differences in 13 of 145 screens tested, but all differences have already been approved: view differences detected.

Meticulous evaluated ~4 hours of user flows which tested 109/212 of the executable lines edited in your PR¹.

_{1. These 103 untested lines will likely automatically gain test coverage over the coming days, however if you wish to increase coverage immediately you can do so by interacting with your feature on localhost.}

_{Last updated for commit aedbc1a Allow retrying a failed manual upload token request. This comment will update as new commits are pushed.}

[greptile-apps]

Greptile Summary

This update improves upload-tool setup by making account upload-token recovery available directly in the profile UI. The previously reported recovery problem is no longer outstanding.

Confidence Score: 5/5

Safe to merge.

No outstanding findings remain. The prior upload-token recovery thread was resolved by greptile-apps[bot] without explanation.

_{Reviews (3): Last reviewed commit: "Merge main and preserve external tool na..." | Re-trigger Greptile}