geenforce client: make ApiToken optional for IP-allowlisted kiosks

Get-ShopdbConfig required both BaseUrl AND ApiToken, so a token-less kiosk
(authorized by the server's IP allowlist) got a null config and never ran.
Now BaseUrl alone is a valid config; X-API-Key is sent only when a token is
present (New-ShopdbAuthHeaders), so token-authorized sites are unchanged and
vaulted-network sites need no per-PC token.

plugins/geenforce/client/Invoke-ShopdbEnforce.ps1

@@ -85,7 +85,7 @@ try {
 
     $config = Get-ShopdbConfig -BaseUrl $BaseUrl -ApiToken $ApiToken
     if (-not $config) {
-        Write-Log 'No shopdb BaseUrl/ApiToken configured yet - retry next cycle.' 'WARN'
+        Write-Log 'No shopdb BaseUrl configured yet - retry next cycle.' 'WARN'
         exit 0
     }