Show the kiosk label prefix, and let a plugin declare the settings it owns

CHANGELOG.md

@@ -10,6 +10,35 @@ ADR-007 and ADR-002.
 
 ## [Unreleased]
 
+### Fixed
+
+- The 3D parts kiosk label prefix never appeared on the kiosk. The kiosk runs
+  logged out, and an unauthenticated read of a setting is limited to an
+  allowlist the key was not on, so the kiosk got a 404 and fell back to no
+  prefix. An admin previewing the same page while logged in saw it, which is
+  why it looked like it worked. A plugin now declares which of its settings a
+  logged-out page may read.
+- The same setting also looked like it would not save. The row did not exist on
+  a site that installed the plugin before the setting was added, so the first
+  save created it - under a placeholder category, where the settings page, which
+  lists by category, could no longer see it. The value was in the database the
+  whole time. A first-time save now files the key under the category its owner
+  declares. Any row already misfiled is repaired in place on upgrade, value
+  untouched. The 3D parts alert email and the employee directory host were in
+  that state.
+- Settings added in a later plugin version never reached a site that installed
+  an earlier one. The seeding ran from `on_install` / `on_enable`, which fire
+  only on a state transition, so neither ran again on an upgrade - and the
+  comment claiming enable ran every upgrade cycle was wrong.
+  `flask plugin upgrade-all` now seeds missing declared settings, without
+  touching values a site has configured.
+
+### Added
+
+- Plugin contract 0.16.0: `get_settings_defaults()` lets a plugin declare the
+  settings it owns (key, default, type, category, description, and whether an
+  unauthenticated caller may read it). See `docs/PLUGIN-HOOKS.md`.
+
 ## [0.8.1] - 2026-08-05
 
 Everything here shipped after v0.8.0 was tagged the same morning, driven by two