docs: wiki update for API docs, printer installer, geenforce cutover, timezone

Execute WIKI-UPDATE-PLAN.md (14 items):
- NEW docs/PRINTER-INSTALLER.md: install-list / pc-default / install-batch
  contract + public installer map page.
- NEW-shape docs/API-REFERENCE.md: index + pointer to the live generated docs
  (/api/docs Redoc, openapi.json, llms.txt, MCP), replacing a stale full dump.
- geenforce cutover + GE-ENFORCE-DISPLAY/CLIENT/DEPLOY: server-first display
  dispatcher (display-role by FQDN, display-type.txt fallback), dashboarddefaults
  FQDN keying, legacy kiosk autostart self-heal (Wow6432Node), per-PC-type
  cutover status.
- PLUGINS: printers/slides rows + plugin-permissions note (slides.manage).
- IMPORT-API: dashboarddefaults FQDN-first keying.
- CONFIG: word-wise search, site_timezone setting.
- PILOT-DEPLOY: servers-to-network reclassify step. IMPORT-ADOPTION: fixup note.
- CLAUDE.md: test count 1077->1159, HTTPS-cutover state. CHANGELOG: timezone +
  kiosk-autostart fixes, site_timezone setting.

docs/geenforce-api-cutover.md

@@ -335,18 +335,51 @@ entry that got reinstalled). `Always`/no-detection entries install every cycle
 by design and are not flagged, so the server-side status derivation
 (`service.record_enforcement_report`: failed > selfhealed > ok) stays honest.
 
-### The display-type.txt dispatcher pattern
+### The display dispatcher: server-resolved role, file fallback
 
 For kiosks, per-subtype behavior does not fork the scope: ONE scope
-(`gea-shopfloor-display`), one inline dispatcher entry that reads
-`C:\Enrollment\display-type.txt` at enforce time and acts on it. Subtype
-changes are a one-file edit plus the next 15-min cycle, and retargeting a
-subtype is a table edit in `seed_display_scope.py` + republish. The dispatcher
-writes an all-users Startup shortcut (never Start-Process - see gotchas), and
-sweeps stale kiosk launchers first (its own `ShopDB Kiosk*.lnk`, the imaging
-installers' `GE Aerospace Dashboard*`/`GE Aerospace Lobby*` shortcuts, any
-browser .lnk with `-kiosk`-ish args or shopdb URLs, and .url files pointing at
-the kiosk routes).
+(`gea-shopfloor-display`), one inline dispatcher entry (built by
+`plugins/geenforce/seed_display_scope.py`) that resolves what the display should
+show at enforce time, in two steps:
+
+1. **Server (authoritative):** `GET
+   $KioskBaseUrl/api/dashboarddefaults/display-role?fqdn=<own-fqdn>`. This is a
+   PUBLIC endpoint (no token). The server matches the FQDN against the
+   `dashboarddefaults` table (IP fallback) and returns `{role, path,
+   businessunitid, businessunit}`. Roles: `dashboard`, `lobby`, `partskiosk`.
+   Changing a display's job is now a server-side edit; no touch on the PC.
+2. **Fallback (offline, or unmapped):** the local
+   `C:\Enrollment\display-type.txt` value against the `DISPLAY_TYPE_TARGETS` map
+   baked into the script. If neither resolves, the dispatcher logs and
+   configures nothing.
+
+The FQDN is built as `F<BIOS serial>.<domain>` (GE device naming); the domain
+comes from HKLM `DisplayFqdnDomain` or the built-in default
+(`device.geaerospace.net`). `DetectionMethod = Always`, but the script is
+idempotent: it rewrites the all-users Startup shortcut (never Start-Process -
+see gotchas) only when the resolved target changed.
+
+### Legacy autostart self-heal
+
+The old GE Aerospace Dashboard / Lobby Display Inno installers planted three
+autostarts each: a Public-Desktop `.lnk`, an all-users Startup `.lnk`, and an
+`HKLM ...\CurrentVersion\Run` value, all launching Edge at now-dead URLs
+(`/shopfloor-dashboard/`, `/tv-dashboard/`) which 404 to a white screen. Because
+those installers were 32-bit, the Run value was WOW64-redirected into
+`HKLM\SOFTWARE\Wow6432Node\...\Run`, invisible to 64-bit tooling - the reason it
+survived earlier cleanup. The dispatcher (`build_dispatcher_script` in
+`seed_display_scope.py`) now sweeps, every enforce cycle: both the native and
+Wow6432Node registry views, every loaded user hive (HKU), Run + RunOnce +
+Policies\Explorer\Run, matching by the legacy value names AND by any value
+pointing at the old URLs; plus every per-user and common Startup folder; then
+kills any running old-URL Edge. A read-only locator,
+`pxe-images/github/find-legacy-kiosk-autostart.ps1`, hunts all these locations
+(and Edge startup-URL policy, scheduled tasks, Assigned Access) when a straggler
+persists.
+
+The kiosk shortcut is a direct Edge shortcut (no launcher/VBS); the fix ships by
+re-publishing the code-authored `gea-shopfloor-display` scope
+(`seed_display_scope(publish=True)`), not an import-share.
 
 ---