printedparts stage 7: the kiosk - scan bin, scan badge, keypad, take

Two open endpoints: an item lookup by scanned code and the take POST -
the product's first unauthenticated write, held to the decision
record's bar (decrement-only, badge-attributed server-side, bounded,
physically rate-limited; justification in the plugin README). The
/parts-kiosk route is a full-screen no-auth view beside /shopfloor: a
hidden always-focused input consumes keyboard-wedge scans for
whichever step is active, TouchKeypad (net-new 3x4 grid) takes the
quantity, and a success screen resets after a few seconds. Manual
type-in fallbacks cover damaged labels. Kiosk test proves open access,
the over-take guard, the badge policy, and cache==ledger afterward.

plugins/printedparts/README.md

@@ -41,3 +41,19 @@ pytest plugins/printedparts/tests/
 - `docs/PLUGIN-QUICKSTART.md` - 30-minute walkthrough
 - `migrations/adr/ADR-001-asset-as-platform-contract.md` - the platform contract
 - `migrations/adr/ADR-002-plugin-versioning.md` - versioning rules
+
+## Why the kiosk take endpoint is unauthenticated
+
+`POST /api/printedparts/kiosk/take` is the product's first open WRITE (every
+other kiosk endpoint is a read). Accepted deliberately, against the criteria
+in docs/proposals/printedparts-plugin.md:
+
+1. Decrement-only: it can reduce stock of an active item, nothing else.
+2. Fully attributed: it refuses to act without a badge that resolves under
+   the site policy; every action lands in the ledger with SSO + name + time.
+3. Bounded blast radius: worst case is stock counts driven low - visible in
+   the ledger and reversible with an adjust.
+4. Physically rate-limited: it serves a touch screen on the shop floor;
+   nothing enumerable, nothing worth scraping.
+
+Any future open-write endpoint must clear the same bar.