Shut the parts kiosk behind a device token, and stop the health probe leaking

Both from the second Darkwing scan. Every claim in it was verified against the
code before acting.

The kiosk was the product's only unauthenticated write, justified by a decision
record saying it was "physically rate-limited: it serves a touch screen on the
shop floor". Nothing in code enforced the physical half, and an HTTP route is
reachable from wherever the app is. What that left open:

  - _kiosk_find_item falls back to matching bare digits against the numeric
    tail of every active item, so 1, 2, 3 walk the catalogue without knowing a
    barcode;
  - a badge is a short numeric SSO, and the route answered 422 for an unknown
    one and 200 for a real one - an oracle for sorting guesses into employees;
  - the write then decremented stock and stamped the ledger, which IS the audit
    trail, with whatever SSO the caller supplied;
  - quantity was bounded only by what was on hand, so one request emptied a bin.

A badge is attribution, never authorization. Both kiosk routes now need the
site's kiosk flag AND a per-device token, and 404 rather than 403 without them
so a caller does not learn the door is there. The READ is gated too: gating only
the write would have left the enumeration oracle running against a kiosk a site
had switched off.

The token is per-DEVICE, not per-page, because a kiosk is a browser on a touch
screen and a token served inside the page is readable by anyone who can load it.
An admin opens the screen once as /parts-kiosk?token=..., the page moves it into
that browser's localStorage and strips it from the address bar.

Also: quantity is capped per take, JSON true no longer passes as 1
(isinstance(True, int) is True), and every badge failure on the anonymous route
returns one message. The gated restock and adjust handlers keep the specific
message - there the person is known and the detail is help, not an oracle. I
changed the wrong one of those three handlers first; caught by the test.

/api/dashboard/health formatted str(e) straight into the body of a route
PUBLIC_ENDPOINTS declares open because "monitoring has no account". A pymysql
OperationalError names the database account, the app host's address, the driver
and the failing statement. It is logged server-side now and the body carries a
coarse status. The version goes with it - it told an anonymous caller which
release to look up. Status stays 200 either way: a monitor keyed on the body's
status field is the contract here, and turning a degraded database into a
transport failure is a separate decision from not leaking the exception.

Nine tests. The three gate tests were confirmed to fail with the gate stubbed
out, rather than assumed to cover it. Suite 2325, frontend 316, build clean.

Scope: product

plugins/printedparts/frontend/views/PartsKiosk.vue

@@ -92,7 +92,7 @@
 
 <script setup>
 import { ref, onMounted, onBeforeUnmount, nextTick } from 'vue'
-import { printedpartsApi, settingsApi } from '@/api'
+import { printedpartsApi, settingsApi, KIOSK_TOKEN_KEY } from '@/api'
 import { withBase } from '@/utils/basePath'
 import TouchKeypad from '@/components/TouchKeypad.vue'
 
@@ -116,7 +116,28 @@ const scannedRevision = ref(null)
 const entryInput = ref(null)
 let resetTimer = null
 
+// Claim the device token, once, from the URL an admin used to set this screen
+// up: /parts-kiosk?token=<value>. It is kept in THIS browser and stripped from
+// the address bar immediately, so it does not sit in the URL for a shoulder to
+// read, and does not travel in a bookmark or a screenshot. Every kiosk call
+// then carries it as X-Kiosk-Token; without it the routes answer 404.
+function claimTokenFromUrl() {
+  try {
+    const url = new URL(window.location.href)
+    const token = (url.searchParams.get('token') || '').trim()
+    if (!token) return
+    localStorage.setItem(KIOSK_TOKEN_KEY, token)
+    url.searchParams.delete('token')
+    window.history.replaceState({}, '', url.pathname + url.search + url.hash)
+  } catch {
+    // A browser refusing localStorage is a browser this kiosk cannot be
+    // provisioned in. Nothing to recover here; the routes will 404 and the
+    // operator sees the standard error.
+  }
+}
+
 onMounted(async () => {
+  claimTokenFromUrl()
   // A kiosk left running for weeks reads this once at load, which is fine: the
   // label format is a property of the site's physical tags, not something that
   // changes during a shift.