Add Image Security Toolkit (tools)

Library:
- Add peek_image() to detect Stegasoo headers without decrypting

CLI:
- stegasoo tools capacity <image> - show LSB/DCT capacity
- stegasoo tools strip <image> - remove EXIF metadata
- stegasoo tools peek <image> - detect hidden data

API:
- POST /api/tools/capacity
- POST /api/tools/strip-metadata
- POST /api/tools/peek

WebUI:
- /tools page with tabbed interface (login required)
- Basic implementation - needs polish (dropzones, better results)

Architecture: Library -> CLI -> API -> WebUI pattern

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

PLAN-4.1.0.md

@@ -426,6 +426,23 @@ Or simpler: detect on startup, update schema automatically (current pattern).
 ## Progress
 
 - [x] Multi-User Support (commit 7b33501)
-- [ ] Channel Key QR (Web UI)
+- [x] Channel Key QR (Web UI) - added QR generator on About page
 - [x] CLI Channel Commands
-- [ ] Advanced Tools
+- [x] Saved Channel Keys (Web UI) - users can save/manage channel keys
+- [ ] Advanced Tools (in progress)
+
+---
+
+## Action Item: Architectural Review
+
+Review other modules for consistency with the Library → CLI → API → WebUI pattern:
+
+| Module | Library | CLI | API | WebUI | Notes |
+|--------|---------|-----|-----|-------|-------|
+| encode | ✓ | ✓ | ✓ | ✓ | Review for consistency |
+| decode | ✓ | ✓ | ✓ | ✓ | Review for consistency |
+| channel | ✓ | ✓ | - | ✓ | Needs API layer? |
+| tools | ✓ | WIP | ✓ | WIP | Building now |
+| generate | ✓ | ? | - | ✓ | CLI for credential gen? |
+
+Priority order: Developer/CLI → API integrator → WebUI end-user