Docs: the USB kiosk, its endpoints and why the list costs a badge

Changelog, the plugin table, the three kiosk endpoints in the API inventory,
and regenerated openapi.json / PROJECT-MAP.

CHANGELOG.md

@@ -12,6 +12,39 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- **USB kiosk: check a drive out and back in without a login.** The people who
+  actually take USB drives are standing at the cabinet, and most of them have no
+  ShopDB account - so check-out and check-in were gated behind a login that was
+  not doing much anyway, since both modes already attribute the action to a
+  scanned BADGE rather than to the signed-in user. `/usb-kiosk` is a full-screen
+  touch screen modelled on the parts kiosk, and works against the self-hosted
+  tables or an existing `cmmc_usb` database.
+
+  It meets the same bar as the parts kiosk: it can move a device between
+  checked-out and checked-in and nothing else - no create, edit or retire - and
+  it does not exist at all until a site sets `usb_kiosk_enabled`. An
+  unauthenticated write is a decision about the door.
+
+  The drives carry no barcode, so unlike the parts kiosk there is nothing to
+  present and the screen has to offer a LIST. That widens what a logged-out
+  screen exposes, so the list is not anonymous: an SSO comes first and has to
+  resolve to a real person before any drive is named - the same bar taking one
+  already had to clear. The main screen shows the caller's own drives, what is
+  free, and a COUNT of everything else; the holders of other people's drives
+  appear only behind a deliberate second tap, so a passer-by cannot read the
+  whole cabinet off a wall panel.
+
+  A badge that resolves to no employee is REFUSED, unlike the signed-in route
+  which creates the user row: a checkout nobody can trace to a person defeats
+  the point, and at a kiosk there is no operator standing there to vouch for it.
+
+  Returning somebody else's drive asks first, then records the badge that was
+  scanned - so the log says who actually handed it back, which is the honest
+  record and needs no change to a schema this app does not own. Refusing a
+  mismatch outright is available as a setting, but is not the default: a drive
+  left behind by somebody on leave would then be unreturnable at the kiosk,
+  which just moves the problem to a person with a login.
+
 - **Audit log retention.** The audit log is append-only and nothing ever removed
   a row, so it grew for as long as a site ran - here to the point where the
   audit page was tens of thousands of pages deep and therefore useless, because