printedparts: catalog access is printedparts.view-gated

Browsing the catalog (item list, detail, file listings) now requires
authentication plus the view permission, and the /printedparts pages
and the label print page require login. Still deliberately open: the
kiosk endpoints per the decision record, the image serve and file
download (img tags and anchor downloads cannot carry a JWT), and the
reports (product-wide jwt-optional convention). Grant
printedparts.view to the roles that should see the catalog.

tests/test_plugins/test_printedparts_ledger.py

@@ -121,6 +121,15 @@ def test_anonymous_cannot_mutate(client, item):
                        json={'quantity': 1, 'badge': '1'}).status_code == 401
 
 
+def test_catalog_reads_require_view_permission(client, member_headers, item):
+    """Browsing the catalog is printedparts.view-gated; the kiosk stays open."""
+    assert client.get('/api/printedparts/items').status_code == 401
+    assert client.get(f'/api/printedparts/items/{item}').status_code == 401
+    assert client.get('/api/printedparts/items',
+                      headers=member_headers).status_code == 403
+    assert client.get('/api/printedparts/kiosk/item/3DP-9001').status_code == 200
+
+
 def test_member_without_permission_gets_403(client, member_headers, item):
     """Authentication alone is not authorization: a role-less user is denied."""
     assert client.post('/api/printedparts/items', json={'itemname': 'X'},
@@ -248,12 +257,14 @@ def test_retire_hides_and_restore_returns(client, auth_headers, item):
     assert client.delete(f'/api/printedparts/items/{item}',
                          headers=auth_headers).status_code == 200
 
-    listed = client.get('/api/printedparts/items').get_json()['data']
+    listed = client.get('/api/printedparts/items',
+                        headers=auth_headers).get_json()['data']
     assert all(row['printeditemid'] != item for row in listed)
     kiosk = client.get('/api/printedparts/kiosk/item/3DP-9001')
     assert kiosk.status_code == 404
 
-    including = client.get('/api/printedparts/items?active=false')
+    including = client.get('/api/printedparts/items?active=false',
+                           headers=auth_headers)
     assert any(row['printeditemid'] == item
                for row in including.get_json()['data'])
 
@@ -286,7 +297,8 @@ def test_file_revisions_append_and_download(client, auth_headers, item, tmp_path
                       content_type='multipart/form-data')
     assert bad.status_code == 400
 
-    listing = client.get(f'/api/printedparts/items/{item}/files').get_json()['data']
+    listing = client.get(f'/api/printedparts/items/{item}/files',
+                         headers=auth_headers).get_json()['data']
     assert [f['revision'] for f in listing] == [2, 1]
 
     fileid = listing[1]['fileid']