Custom HTTP tools an administrator defines

A row in custom_tools becomes a ToolDef like any built-in, offered beside
the thirteen. The registry had to stop being an import-time constant for
that: `resolve_tools` now returns the schemas *and* the runners together,
carried to the loop on the ToolContext.

That closes a hole on the way. `run_tool` looked names up in the global
REGISTRY with no reference to what had been offered, so a model naming a
tool its chat was gated out of -- a family switched off, a permission the
reader lacks -- had it run anyway. The resolved set is now authoritative.

Arguments come from a model, so an argument may fill a hole but never move
the target: the scheme and host of a URL template are literal, values are
escaped for where they land, and the origin is pinned afterwards. Every
redirect hop is checked the way services/fetch.py checks one, and the
secret is dropped if a hop leaves the origin it was issued for.

Also fixes the tool-activity block claiming every library tool had
"searched the web", which it has done since the second family landed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/services/generation.py

@@ -239,7 +239,11 @@ async def _run(generation: Generation) -> None:
             owner = db.get(User, chat.user_id)
 
             # Read while the session is open: everything below outlives it.
-            offered = tools_service.enabled_tools(db, chat, owner)
+            # Resolved once, so that what the loop is allowed to *run* is the
+            # same set the endpoint was *offered* -- not whatever happens to
+            # exist by the time a call comes back.
+            toolset = tools_service.resolve_tools(db, chat, owner)
+            offered = toolset.schemas
             payload = chat_service.build_request(
                 db, chat, upto=message, tools=offered, user=owner
             )
@@ -248,7 +252,7 @@ async def _run(generation: Generation) -> None:
             # Read here, with the rest, because titling happens after this
             # session has closed and must not open another one.
             title_prompt = prompts_service.resolve(db, "task.title")
-            tool_context = tools_service.context_for(db, owner, chat)
+            tool_context = tools_service.context_for(db, owner, chat, tools=toolset)
 
             model = chat_service.model_for(db, chat)
             generation.context_limit = model.context_length if model is not None else 0