Refuse a kiosk caller wearing an address that belongs to the path

Both kiosks admit a check-in or check-out with no login when the caller sits in
a configured network. The subtraction that makes that safe was missing.

A reverse proxy normally sits ON the plant network a site enters in the
allowlist. When the proxy forwards nothing - misconfigured, or something
bypassed it - the request arrives wearing the proxy's own address, which matches
the allowlist, while carrying no evidence whatever about who sent it. That is
the one case that has to refuse, and it was being admitted. The previous
fail-closed test only looked closed because the proxy in it happened to sit
outside the range.

Addresses that belong to the path are now subtracted before the allowlist is
consulted: loopback always, since no site's kiosk is the server itself, plus
whatever the site declares as its proxies. USB and printedparts get the same
treatment - they had diverged for no reason anybody chose.

Three more, same surface:

A range that admits everybody can no longer be saved by accident. 0.0.0.0/0 and
::/0 are refused outright, anything wider than a site plausibly needs is refused
unless an explicit override is set, and the refusal says why.

The kiosk token no longer travels in a URL. The provisioning link carries a
single-use setup code redeemed on first open, so the token stays out of browser
history, referrers and proxy logs. The route is declared public deliberately:
the secret is the code, the way a password-reset link is the secret.

The badge-to-name lookup is bounded. It answers without a login and is now
reachable from a whole network rather than one screen, so a source that keeps
missing gets refused rather than being allowed to walk the directory. On by
default, budget and kill switch are settings.

All four new settings carry controls on their settings pages. A setting that can
stop the kiosk, or widen it, must not be reachable only by hand-editing rows.

The installer's client-IP advice is corrected: it described the opposite of what
the shipped waitress flags do, and named only GE-Enforce as the thing that
breaks when the rule is absent, when the two kiosk allowlists depend on it too.

plugins/usb/api/selfhosted.py

@@ -343,6 +343,27 @@ def kiosk_device(device_id):
     })
 
 
+def _badge_not_recognised(suffix=''):
+    """One unrecognised scan, counted against the caller, then the refusal.
+
+    WHY COUNTED. The answer to a recognised badge is an employee's NAME, and a
+    badge is a short number, so this is a lookup somebody admitted to the kiosk
+    can walk. Network-position admission can now mean a whole VLAN rather than
+    one screen by the cabinet, so the number of badges a caller may guess wrong
+    has to be bounded. The budget lives in routes.py alongside the admission
+    checks; the import is deferred because routes imports this module.
+
+    The wording stays per-action ("to check this device out"), because the
+    person at the screen is being told what did not happen.
+    """
+    from .routes import record_badge_miss
+
+    record_badge_miss()
+    return error_response(ErrorCodes.VALIDATION_ERROR,
+                          'Badge not recognized - see IT' + suffix,
+                          http_code=422)
+
+
 def kiosk_session(data):
     """See routes.kiosk_session for why the list costs a valid badge."""
     badge, badgeerror = _kiosk_badge_digits(data.get('badge'))
@@ -350,8 +371,7 @@ def kiosk_session(data):
         return badgeerror
     name = _resolve_name(badge)
     if not name:
-        return error_response(ErrorCodes.VALIDATION_ERROR,
-                              'Badge not recognized - see IT', http_code=422)
+        return _badge_not_recognised()
 
     yours, available, others = [], [], 0
     for device in USBDevice.query.filter_by(isactive=True).order_by(
@@ -377,8 +397,7 @@ def kiosk_others(data):
     if badgeerror:
         return badgeerror
     if not _resolve_name(badge):
-        return error_response(ErrorCodes.VALIDATION_ERROR,
-                              'Badge not recognized - see IT', http_code=422)
+        return _badge_not_recognised()
 
     out = []
     for device in USBDevice.query.filter_by(isactive=True, ischeckedout=True
@@ -419,10 +438,7 @@ def kiosk_checkout(data):
     # path. A checkout nobody can trace to a person defeats the tracking.
     name = _resolve_name(badge)
     if not name:
-        return error_response(
-            ErrorCodes.VALIDATION_ERROR,
-            'Badge not recognized - see IT to check this device out',
-            http_code=422)
+        return _badge_not_recognised(' to check this device out')
 
     now = datetime.now(timezone.utc).replace(tzinfo=None)
     # The transition IS the guard. The ischeckedout test above reads, decides
@@ -477,10 +493,7 @@ def kiosk_checkin(data):
 
     name = _resolve_name(badge)
     if not name:
-        return error_response(
-            ErrorCodes.VALIDATION_ERROR,
-            'Badge not recognized - see IT to return this device',
-            http_code=422)
+        return _badge_not_recognised(' to return this device')
 
     holderbadge = (device.currentuserid or '').strip()
     if holderbadge and holderbadge != badge: