printedparts: catalog access is printedparts.view-gated

Browsing the catalog (item list, detail, file listings) now requires
authentication plus the view permission, and the /printedparts pages
and the label print page require login. Still deliberately open: the
kiosk endpoints per the decision record, the image serve and file
download (img tags and anchor downloads cannot carry a JWT), and the
reports (product-wide jwt-optional convention). Grant
printedparts.view to the roles that should see the catalog.

docs/PLUGIN-LAB-PRINTEDPARTS.md

@@ -371,6 +371,20 @@ Two more field requests, and the plugin's FIRST incremental migration:
    ACTIVE member of each selected role (role.users backref), deduped with
    the user picks and free-text; settings page gains a role picker.
 
+## Stage 16a (extension) - view permission on the catalog
+
+The catalog started with open reads (the product's jwt-optional list
+convention). Field decision: browsing and managing the parts catalog is
+staff-only, so the reads (list, detail, file listings) move behind
+`@jwt_required()` + `require_permission('printedparts.view')`, the
+`/printedparts` routes and the label print page gain `requiresAuth`, and
+the view permission becomes meaningful in the role grid.
+Deliberately still open: the kiosk endpoints (decision record), the image
+serve and file download (fetched by `<img>` tags and anchor clicks, which
+cannot carry a JWT header), and the reports (product-wide jwt-optional
+convention). Grant `printedparts.view` to the roles that should see the
+catalog - admins bypass as always.
+
 ## Stage 16 (extension) - kiosk touch fixes from first hands-on use
 
 First real touchscreen session found two problems worth their own stage: