docs: wiki update for API docs, printer installer, geenforce cutover, timezone

Execute WIKI-UPDATE-PLAN.md (14 items):
- NEW docs/PRINTER-INSTALLER.md: install-list / pc-default / install-batch
  contract + public installer map page.
- NEW-shape docs/API-REFERENCE.md: index + pointer to the live generated docs
  (/api/docs Redoc, openapi.json, llms.txt, MCP), replacing a stale full dump.
- geenforce cutover + GE-ENFORCE-DISPLAY/CLIENT/DEPLOY: server-first display
  dispatcher (display-role by FQDN, display-type.txt fallback), dashboarddefaults
  FQDN keying, legacy kiosk autostart self-heal (Wow6432Node), per-PC-type
  cutover status.
- PLUGINS: printers/slides rows + plugin-permissions note (slides.manage).
- IMPORT-API: dashboarddefaults FQDN-first keying.
- CONFIG: word-wise search, site_timezone setting.
- PILOT-DEPLOY: servers-to-network reclassify step. IMPORT-ADOPTION: fixup note.
- CLAUDE.md: test count 1077->1159, HTTPS-cutover state. CHANGELOG: timezone +
  kiosk-autostart fixes, site_timezone setting.

docs/GE-ENFORCE-DEPLOY.md

@@ -106,6 +106,12 @@ retrofit it. `-NoTask` provisions identity + kit without registering the task.
 
 Re-running it updates identity/config and re-registers the task in place.
 
+For PC types that have cut over to HTTPS manifest delivery (currently
+displays/kiosks), the full server-side setup, auth model (IP allowlist vs
+ApiToken), and per-PC-type cutover playbook live in `geenforce-api-cutover.md`.
+This doc covers what gets laid on the PC; that doc covers where the manifest
+comes from.
+
 ---
 
 ## 5. The engine boundary