docs: wiki update for API docs, printer installer, geenforce cutover, timezone

Execute WIKI-UPDATE-PLAN.md (14 items):
- NEW docs/PRINTER-INSTALLER.md: install-list / pc-default / install-batch
  contract + public installer map page.
- NEW-shape docs/API-REFERENCE.md: index + pointer to the live generated docs
  (/api/docs Redoc, openapi.json, llms.txt, MCP), replacing a stale full dump.
- geenforce cutover + GE-ENFORCE-DISPLAY/CLIENT/DEPLOY: server-first display
  dispatcher (display-role by FQDN, display-type.txt fallback), dashboarddefaults
  FQDN keying, legacy kiosk autostart self-heal (Wow6432Node), per-PC-type
  cutover status.
- PLUGINS: printers/slides rows + plugin-permissions note (slides.manage).
- IMPORT-API: dashboarddefaults FQDN-first keying.
- CONFIG: word-wise search, site_timezone setting.
- PILOT-DEPLOY: servers-to-network reclassify step. IMPORT-ADOPTION: fixup note.
- CLAUDE.md: test count 1077->1159, HTTPS-cutover state. CHANGELOG: timezone +
  kiosk-autostart fixes, site_timezone setting.

docs/CONFIG.md

@@ -145,6 +145,14 @@ read back through the API.
 | `printer_hostname_template` | `Printer-{ip}.printer.geaerospace.net` | Printer hostname template. `{ip}` is the dash-separated IP address. |
 | `contact_email_domain` | `geaerospace.com` | Email domain appended to a support contact's SSO to build email (`sso@domain`) and Teams-chat links. Blank hides the contact action buttons. |
 | `dualpath_single_machine` | `true` | Treat a Dualpath pair (a dual-bay machine with one controller) as a single machine in the machines list, dashboard/report counts, and the floor map (the secondary bay is hidden). The data model always keeps both bay records; detail pages stay per-bay with a sibling banner. `false` lists and counts both bays separately. |
+| `site_timezone` | `America/New_York` | IANA timezone for the site. Notification start/end times are entered and displayed in this zone (not the viewer's browser zone), and daily-reset notification expiry (`expirymode=dailytime`) is computed here. Editable in Settings > Site > Localization. Public-readable so kiosks/clients can resolve it. |
+
+Notification times are stored and served in UTC; the frontend converts to
+`site_timezone` via `frontend/src/utils/datetime.js` (Intl-based, DST-safe).
+
+Change note: notification times are now timezone-correct (stored UTC, shown in
+`site_timezone`); this fixes the prior offset bug where a 2:34 PM entry displayed
+as 6:34 PM.
 
 ### branding
 
@@ -319,6 +327,11 @@ One boolean key per search domain, keyed `search_<type>_enabled` (default
 `true`). Toggles whether a domain appears in global search results. The set is
 generated from `SEARCH_DOMAINS` in `shopdb/core/api/settings.py`.
 
+Search terms are matched word-wise: a multi-word query returns rows containing
+EVERY word, each word anywhere in the searched fields, in any order ("CSF Roles"
+matches a row with "CSF" and "Roles" in different columns). Quoting does not
+force a contiguous phrase.
+
 ## Custom fields
 
 Site-defined extra attributes per asset type (Settings > Custom Fields, table