Gate both kiosks behind a device token, and make an unreachable setting a test failure

plugins/usb/frontend/views/USBKiosk.vue

@@ -133,7 +133,7 @@
 
 <script setup>
 import { ref, computed, onMounted, onBeforeUnmount, nextTick } from 'vue'
-import api, { settingsApi } from '@/api'
+import api, { settingsApi, claimKioskToken, KIOSK_TOKEN_KEYS } from '@/api'
 import TouchKeypad from '@/components/TouchKeypad.vue'
 import { filterdrives } from '../drivefilter'
 
@@ -150,6 +150,7 @@ const entryInput = ref(null)
 let resetTimer = null
 
 onMounted(async () => {
+  claimKioskToken(KIOSK_TOKEN_KEYS['/usb/kiosk/'])
   // The kiosk ships off. Reading the flag turns "everything 404s" into a screen
   // that says so - a kiosk merely switched off must not look broken.
   try {

plugins/usb/frontend/views/USBSettings.vue

@@ -33,6 +33,28 @@
         </p>
       </div>
 
+      <div class="form-group">
+        <label>Kiosk device token</label>
+        <div class="token-row">
+          <input v-model="values.usb_kiosk_token" type="text"
+                 class="form-control" placeholder="not set" />
+          <button type="button" class="btn btn-secondary" @click="generateToken">
+            Generate
+          </button>
+        </div>
+        <p class="field-hint">
+          Provision each screen once by opening
+          <code>/usb-kiosk?token=&lt;this value&gt;</code> on it. That browser
+          keeps it; the address bar does not. Turning the kiosk on is a
+          decision, not a credential - without this token the routes answer 404,
+          so nobody who merely finds the URL can move a drive and sign it with a
+          badge they guessed.
+        </p>
+        <p v-if="tokenJustGenerated" class="field-hint token-warn">
+          Copy this now and save. It is masked once stored.
+        </p>
+      </div>
+
       <div class="form-group">
         <label class="check-row">
           <input type="checkbox" v-model="values.usb_kiosk_allow_return_for_others"
@@ -61,12 +83,25 @@ import { ref, onMounted } from 'vue'
 import { settingsApi } from '@/api'
 import { withBase } from '@/utils/basePath'
 
-const KEYS = ['usb_kiosk_enabled', 'usb_kiosk_allow_return_for_others']
+const KEYS = ['usb_kiosk_enabled', 'usb_kiosk_allow_return_for_others',
+              'usb_kiosk_token']
 
 const values = ref({
   usb_kiosk_enabled: false,
   usb_kiosk_allow_return_for_others: true,
+  usb_kiosk_token: '',
 })
+
+const tokenJustGenerated = ref(false)
+
+// Generated in the browser so it never travels anywhere it did not need to.
+function generateToken() {
+  const bytes = new Uint8Array(24)
+  crypto.getRandomValues(bytes)
+  values.value.usb_kiosk_token =
+    Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('')
+  tokenJustGenerated.value = true
+}
 const saving = ref(false)
 const message = ref('')
 const error = ref('')
@@ -106,6 +141,10 @@ onMounted(load)
 </script>
 
 <style scoped>
+.token-row { display: flex; gap: 8px; align-items: center; }
+.token-row .form-control { flex: 1 1 auto; }
+.token-warn { color: var(--warning-dark); }
+
 .field-hint { color: var(--text-light); font-size: 0.85rem; margin-top: 0.25rem; }
 .check-row { display: flex; align-items: center; gap: 0.5rem; font-weight: 600; }
 .check-row input { width: auto; }