Add the printedparts plugin: 3D-printed parts storefront and kiosk

Catalog with photos and append-only print-file revisions, a stock
ledger attributing every take/restock/adjust to a badge-resolved
employee, a touch kiosk (scan bin, scan badge, keypad quantity) with a
deliberately open decrement-only take endpoint, 1x0.5in CODE128 bin
labels, low-stock email alerts to selected users, roles, or addresses,
and stock/consumption/by-person reports with a cache-vs-ledger
reconcile. Ships disabled; enable per site. Contract 0.13.0 adds the
mailer and the User/Role models to the plugin surface.

tests/test_core/test_authz.py

@@ -45,7 +45,12 @@ EXEMPT_BLUEPRINTS = {'auth', 'collector', 'setup'}
 #     shape as the exempt collector blueprint; the geenforce admin endpoints in
 #     the same blueprint are JWT+permission gated and ARE swept.
 EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
-                    'geenforce.post_report'}
+                    'geenforce.post_report',
+                    # Deliberately open kiosk write: decrement-only,
+                    # badge-attributed server-side. Decision record in
+                    # docs/proposals/printedparts-plugin.md; justification in
+                    # the plugin README.
+                    'printedparts.kiosk_take'}
 
 
 @pytest.fixture(autouse=True)