IIS runbook: app pool needs Modify on instance/

The plugin registry (instance/plugins.json), uploaded logos, floor
plans, item photos, and print files all write under instance/; with
the app pool at read-only, toggling a plugin in Settings surfaces as
an internal error and every upload fails. Grant Modify in step 7.3
and add the troubleshooting row.

docs/INSTALL-WINDOWS-IIS.md

@@ -151,6 +151,8 @@ Two supported deployment methods:
    ```powershell
    icacls APP_ROOT /grant "IIS AppPool\shopdbflask:(OI)(CI)RX" /T
    icacls APP_ROOT\logs /grant "IIS AppPool\shopdbflask:(OI)(CI)M" /T
+   mkdir APP_ROOT\instance 2>NUL
+   icacls APP_ROOT\instance /grant "IIS AppPool\shopdbflask:(OI)(CI)M" /T
    ```
 4. **Unlock the handler sections** (locked server-wide by default; without this
    IIS returns **HTTP 500.19**):
@@ -236,6 +238,7 @@ each gets its own site, app pool, port, and venv.
 | IIS **500.52** after enabling the rewrite block | `allowedServerVariables` locked at server level - `appcmd unlock config -section:system.webServer/rewrite/allowedServerVariables`. |
 | Audit log shows only **127.0.0.1** with the rewrite block active | waitress strips untrusted proxy headers - `--trusted-proxy=127.0.0.1 --trusted-proxy-headers=x-forwarded-for` missing from the waitress `arguments`. |
 | **500** with an empty HttpPlatform log | app-pool identity can't read `APP_ROOT` / run the venv (step 7.3), or `.env` missing/invalid. |
+| "internal error" toggling plugins, or uploads fail | app pool cannot WRITE `APP_ROOT\instance` (plugin registry, logos, photos, files live there) - step 7.3 grants it Modify. |
 | "No time zone found with key America/New_York" | `tzdata` not installed (`pip install tzdata`). |
 | Nav missing Equipment/PCs/... | plugins not installed (step 6 `flask plugin install`), or site not recycled. |
 | Method B: blank page / assets 404 under `/ops` | frontend `dist` built without `VITE_BASE_PATH=/ops/` (step 7b.1). |