One badge vocabulary, and images a browser can actually load

Two operator-visible defects and three doc corrections, closing the tail of the
2026-09-03 run.

THE BADGE. The two kiosks read the same physical badges and disagreed. The
parts kiosk understood both shapes a scanner emits - the bare SSO and the PayNo
wrapper 0<digits>BZ - while the USB kiosk compared the raw string to an SSO, so
the wrapper resolved to nobody. An operator whose keyboard-wedge scanner emits
it could take a 3D-printed part and could not check out a drive, with the same
badge, at two cabinets a few metres apart.

The shape now lives in shopdb/utils/badges.py on the contract surface, because
a plugin may not import another plugin and because a badge is a property of the
site rather than of a cabinet. Both kiosks use it, and both store the DIGITS
rather than the string that arrived: one row per spelling makes a custody
history that cannot be joined to itself.

That closed a subtler hole in the same place. str.isdigit() is true for
Arabic-Indic and other decimal forms, and int() parses them, so a badge written
in those characters was accepted, matched a REAL employee, and was then stored
as an SSO string nothing else matches. ASCII digits only. An empty scan and an
unreadable one now get different answers, because they are different problems
for the person at the cabinet.

THE IMAGES. /api/applications/image/<filename> and /api/models/image/<filename>
required a permission, and a browser fetching <img src="..."> sends no
Authorization header - so the gate did not protect the file, it guaranteed the
picture never appeared. Both are ungated now, like the four sibling image routes
(branding logo, map blueprint, employee photo, part picture), and registered in
PUBLIC_ENDPOINTS with that reasoning.

/api/printers/lookup?fqdn= never matched anything: both arguments were compared
against Communication.ipaddress, so a hostname lookup 404d on printers whose
hostname was on the record. An FQDN now matches the hostname, with a fallback to
the short name.

The slide manager gained the per-slide hold time. The PATCH route and the feed
have always carried `seconds`; nothing called it, so the one documented
per-slide control was curl-only.

Docs: API-REFERENCE listed the employee lookups and the whole notifications
surface as unauthenticated when they answer 401, and called both kiosks
"deliberately open" when they are off by default and refuse anything without the
site's device token. The installer download says applications.download, which is
what the code requires. api-inventory.json said printers/lookup was
jwt-optional.

Fourteen tests. The badge rule verified by planting the old per-kiosk behaviour:
three fail, one in each kiosk.

Scope: product

plugins/usb/api/selfhosted.py

@@ -33,18 +33,56 @@ _FILTER = {'available': STATUS_CHECKED_IN, 'checkedout': STATUS_CHECKED_OUT, 're
 
 
 def _resolve_name(sso):
-    """Best-effort name from the self-hosted employee directory."""
+    """Best-effort name from the self-hosted employee directory.
+
+    The badge goes through the shared shape rule first. This compared the raw
+    string, so the PayNo wrapper some scanners emit (0<digits>BZ) resolved to
+    nobody and the kiosk answered "Badge not recognized - see IT" - for a badge
+    the parts kiosk a few metres away accepted. It also used str.isdigit(),
+    true for Arabic-Indic digits, so a badge in those characters reached int()
+    and matched a real employee.
+    """
+    from shopdb.api import BadgeShapeError, normalise_badge
+
+    try:
+        digits = normalise_badge(sso)
+    except BadgeShapeError:
+        return None
     try:
         from plugins.employees.models import DirectoryEmployee
-        if sso and str(sso).isdigit():
-            emp = db.session.get(DirectoryEmployee, int(sso))
-            if emp:
-                return f'{emp.firstname} {emp.lastname}'.strip()
+        emp = db.session.get(DirectoryEmployee, int(digits))
+        if emp:
+            return f'{emp.firstname} {emp.lastname}'.strip()
     except Exception:
         pass
     return None
 
 
+def _kiosk_badge_digits(raw):
+    """Return (digits, errorresponse) for a scanned badge.
+
+    Every kiosk write stores the DIGITS rather than the string that arrived:
+    the PayNo wrapper (0<digits>BZ) and the bare number are the same person,
+    and recording one row under each spelling makes a custody history that
+    cannot be joined to itself.
+
+    An empty scan and an unreadable one get different answers, because they
+    are different problems for the person standing at the cabinet: one has not
+    scanned yet, the other has scanned something this site does not know.
+    """
+    from shopdb.api import BadgeShapeError, normalise_badge
+
+    if not (raw or '').strip():
+        return None, error_response(ErrorCodes.VALIDATION_ERROR,
+                                    'Scan your badge')
+    try:
+        return normalise_badge(raw), None
+    except BadgeShapeError:
+        return None, error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'Badge not recognized - see IT', http_code=422)
+
+
 def _status(device):
     if not device.isactive:
         return STATUS_RETIRED
@@ -307,9 +345,9 @@ def kiosk_device(device_id):
 
 def kiosk_session(data):
     """See routes.kiosk_session for why the list costs a valid badge."""
-    badge = (data.get('badge') or '').strip()
-    if not badge:
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'Scan your badge')
+    badge, badgeerror = _kiosk_badge_digits(data.get('badge'))
+    if badgeerror:
+        return badgeerror
     name = _resolve_name(badge)
     if not name:
         return error_response(ErrorCodes.VALIDATION_ERROR,
@@ -335,9 +373,9 @@ def kiosk_session(data):
 
 
 def kiosk_others(data):
-    badge = (data.get('badge') or '').strip()
-    if not badge:
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'Scan your badge')
+    badge, badgeerror = _kiosk_badge_digits(data.get('badge'))
+    if badgeerror:
+        return badgeerror
     if not _resolve_name(badge):
         return error_response(ErrorCodes.VALIDATION_ERROR,
                               'Badge not recognized - see IT', http_code=422)
@@ -358,9 +396,9 @@ def kiosk_others(data):
 
 def kiosk_checkout(data):
     device_id = (data.get('device_id') or '').strip()
-    badge = (data.get('badge') or '').strip()
-    if not badge:
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'Scan your badge')
+    badge, badgeerror = _kiosk_badge_digits(data.get('badge'))
+    if badgeerror:
+        return badgeerror
 
     device = _find(device_id)
     if not device:
@@ -424,9 +462,9 @@ def kiosk_checkout(data):
 
 def kiosk_checkin(data):
     device_id = (data.get('device_id') or '').strip()
-    badge = (data.get('badge') or '').strip()
-    if not badge:
-        return error_response(ErrorCodes.VALIDATION_ERROR, 'Scan your badge')
+    badge, badgeerror = _kiosk_badge_digits(data.get('badge'))
+    if badgeerror:
+        return badgeerror
     forsomeoneelse = bool(data.get('forsomeoneelse'))
 
     device = _find(device_id)