Docs audit fixes: kiosk code drift, PowerShell chains, links, leaks, CI auth

.github/workflows/ci.yml

@@ -75,10 +75,16 @@ jobs:
           python-version: '3.12'
           cache: pip
       - run: pip install -r requirements.txt
-      - name: Force utf8mb4 on the CI database
+      - name: Prime the CI database (utf8mb4 + native auth for pymysql)
+        # MySQL 8 defaults root to caching_sha2_password, which pymysql can
+        # only speak with the 'cryptography' package. Rather than add that
+        # dependency (and its offline wheel), switch root to native auth here
+        # via the mysql CLI, so the app's pymysql connections work as-is.
         run: |
           mysql -h 127.0.0.1 -uroot -proot -e \
-            "ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
+            "ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; \
+             ALTER USER 'root'@'%' IDENTIFIED WITH mysql_native_password BY 'root'; \
+             FLUSH PRIVILEGES;"
       - name: Fresh core upgrade from empty
         run: flask db upgrade
       - name: Install every bundled plugin (runs its chain)