docs: wiki update for API docs, printer installer, geenforce cutover, timezone

Execute WIKI-UPDATE-PLAN.md (14 items):
- NEW docs/PRINTER-INSTALLER.md: install-list / pc-default / install-batch
  contract + public installer map page.
- NEW-shape docs/API-REFERENCE.md: index + pointer to the live generated docs
  (/api/docs Redoc, openapi.json, llms.txt, MCP), replacing a stale full dump.
- geenforce cutover + GE-ENFORCE-DISPLAY/CLIENT/DEPLOY: server-first display
  dispatcher (display-role by FQDN, display-type.txt fallback), dashboarddefaults
  FQDN keying, legacy kiosk autostart self-heal (Wow6432Node), per-PC-type
  cutover status.
- PLUGINS: printers/slides rows + plugin-permissions note (slides.manage).
- IMPORT-API: dashboarddefaults FQDN-first keying.
- CONFIG: word-wise search, site_timezone setting.
- PILOT-DEPLOY: servers-to-network reclassify step. IMPORT-ADOPTION: fixup note.
- CLAUDE.md: test count 1077->1159, HTTPS-cutover state. CHANGELOG: timezone +
  kiosk-autostart fixes, site_timezone setting.

docs/GE-ENFORCE-DISPLAY.md

@@ -65,7 +65,17 @@ creates a new version).
    re-asserts each cycle, but the script is idempotent (it skips relaunch if a
    kiosk process is already serving the target URL).
 
-### display-type -> target map
+### Role resolution: server first, display-type.txt fallback
+
+The dispatcher first asks the server: `GET
+/api/dashboarddefaults/display-role?fqdn=<fqdn>` (public, unauthenticated). A row
+in `dashboarddefaults` keyed by the display's FQDN (IP fallback) wins and returns
+the role and frontend path directly. Only when the server is unreachable or has
+no mapping does the dispatcher fall back to the local `display-type.txt` map
+below. To repurpose a display, edit its `dashboarddefaults` row; the change takes
+effect on the next enforce cycle.
+
+Fallback map (local file):
 
 | display-type.txt | kiosk route | notes |
 | --- | --- | --- |
@@ -73,6 +83,39 @@ creates a new version).
 | `Lobby` | `/tv` | slides plugin TV dashboard (surface `lobby`) |
 | `3DPrintRoom` | `/parts-kiosk` | **PLACEHOLDER, TODO-confirm** printedparts parts kiosk route; confirm the real 3D-print-room target with the floor team before publishing to production displays |
 
+### Dashboard-defaults FQDN keying
+
+`dashboarddefaults` rows were historically keyed by IP. Migration
+`7d31_dashboarddefault_fqdn` added an `fqdn` column; resolution is now FQDN-first
+with IP as fallback (`_resolve_default` in
+`shopdb/core/api/dashboarddefaults.py`). FQDNs are stored lowercase. This
+survives DHCP churn on kiosk subnets. `POST /api/dashboarddefaults` accepts
+`fqdn`, `ipaddress`, `displayrole` (`dashboard`|`lobby`|`partskiosk`),
+`businessunitid`, and `description`; `displaypath` is not stored but derived from
+the role (`DISPLAY_ROLE_PATHS`). Two public read endpoints consume it:
+`/api/dashboarddefaults/display-role` (dispatcher) and
+`/api/dashboarddefaults/visitor-location` (lobby business-unit lookup). The
+server derives a display's FQDN from its reported BIOS serial as
+`F<serial>.<domain>` (`derive_display_fqdn`, domain from the `display_fqdn_domain`
+setting); the dispatcher in `plugins/geenforce/seed_display_scope.py` builds the
+same FQDN client-side for its lookup.
+
+### Legacy autostart self-heal
+
+The dispatcher also cleans up after the old GE Aerospace Dashboard / Lobby
+Display Inno installers, which planted autostarts (a Public-Desktop `.lnk`, an
+all-users Startup `.lnk`, and an `HKLM ...\CurrentVersion\Run` value) that
+relaunch Edge at now-dead URLs (`/shopfloor-dashboard/`, `/tv-dashboard/`) and
+white-screen. The 32-bit installer's Run value was WOW64-redirected into
+`Wow6432Node`, which is why it survived earlier cleanup. Every enforce cycle the
+dispatcher sweeps both registry views, all loaded user hives, Run/RunOnce/policy
+Run keys, and every per-user and common Startup folder, matching by legacy name
+and by the old URLs, then kills any old-URL Edge. The kiosk shortcut it writes is
+a direct Edge shortcut (no launcher or VBS). The fix ships by re-publishing this
+code-authored scope (`seed_display_scope(publish=True)`), not an import-share.
+`pxe-images/github/find-legacy-kiosk-autostart.ps1` is a read-only locator for
+stragglers.
+
 ## Self-sufficient: displays do NOT inherit common
 
 The `gea-shopfloor-display` scope carries everything a display enforces. It does