Gate both kiosks behind a device token, and make an unreachable setting a test failure

plugins/geenforce/frontend/views/GeEnforceSettings.vue

@@ -1,5 +1,18 @@
 <template>
   <div class="geenforce-settings">
+    <h2>Reporting</h2>
+    <p class="muted">
+      How long a bay may go without posting an enforcement report before the
+      fleet view calls it stale.
+    </p>
+    <label class="field-label" for="stale">Stale after (minutes)</label>
+    <input id="stale" type="number" min="1" class="cidr-input"
+           v-model.number="staleminutes" @blur="saveStale">
+    <small class="input-hint">
+      Default 30. A bay enforces on its own cycle, so set this above the cycle
+      length or every bay reads as stale between runs.
+    </small>
+
     <h2>Client Access</h2>
     <p class="muted">
       Fleet PCs on a trusted network can reach the GE-Enforce client endpoints
@@ -40,9 +53,12 @@
 
 <script setup>
 import { ref, onMounted } from 'vue'
-import api from '@/api'
+import api, { settingsApi } from '@/api'
 
 const cidrs = ref('')
+// Held here rather than in /geenforce/config: that endpoint owns the CIDR
+// allowlist, and this is an ordinary site setting.
+const staleminutes = ref(30)
 const saving = ref(false)
 const message = ref('')
 const ok = ref(false)
@@ -57,6 +73,23 @@ async function load() {
     message.value = 'Could not load config.'
     ok.value = false
   }
+  try {
+    const setting = unwrap(await settingsApi.get('geenforce_reportstaleminutes'))
+    staleminutes.value = Number(setting?.value ?? 30) || 30
+  } catch (e) {
+    staleminutes.value = 30
+  }
+}
+
+async function saveStale() {
+  try {
+    await settingsApi.update('geenforce_reportstaleminutes', String(staleminutes.value))
+    ok.value = true
+    message.value = 'Saved.'
+  } catch (e) {
+    ok.value = false
+    message.value = e?.response?.data?.data?.error?.message || 'Save failed.'
+  }
 }
 
 async function save() {