Every report offers to email itself, and a long drive name stays in its card

POST /api/reports/email has always taken any {columns, rows} from any caller,
but the Email report button existed on the toner and warranty pages only - not
because those reports are special, but because they happen to be their own
routed pages and the reports page had no button at all. It is now beside Export
CSV for every report the page can build a table from, which is all of them:
plugin reports through their declared columns, core reports through the flat
list they return, and the asset inventory summary by flattening its three
tables into one with the grouping named in a column. Presentation-only fields -
a status colour, a link id - are left out; a column of hex codes is worse than
no column. The shapes live in a module with tests rather than in the view.

The button is now hidden without reports.export on all three pages. Offering
somebody a button that can only answer 403 is worse than not offering it.

Separately, on the USB kiosk a long drive name pushed Take or Return out
through the side of its card, leaving a drive nobody could press. The name is a
flex item and so defaulted to min-width:auto, keeping its full intrinsic width;
it now yields, wraps mid-word for the serial-style names that carry no spaces,
and clamps its description to two lines so one long name cannot make every card
in the row tall. The locker line is never clipped - it is how somebody finds
the drive.

CHANGELOG.md

@@ -24,6 +24,27 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **Every report offers to email itself, not just two of them.** `POST
+  /api/reports/email` has always taken any `{columns, rows}`, but the button was
+  on the toner and warranty pages only - because those two happen to be their
+  own routed pages, and the reports page had no button at all. It is now beside
+  Export CSV for every report the page can build a table from, which is all of
+  them: the plugin reports through their declared columns, the core reports
+  through the flat list they return, and the asset inventory summary by
+  flattening its three tables into one with the grouping named in a column.
+  Presentation-only fields - a status colour, a link id - are left out, since a
+  column of hex codes is worse than no column. The button is hidden without the
+  `reports.export` permission the endpoint enforces, on all three pages: offering
+  somebody a button that can only answer 403 is worse than not offering it.
+
+- **A long drive name pushed Take and Return out of the card.** On the USB kiosk
+  the name is a flex item, which defaults to `min-width: auto`, so it kept its
+  full intrinsic width and shoved the button through the side of the card -
+  leaving a drive nobody could take. Names now wrap, including the serial-style
+  ones that carry no spaces at all, and a description is clamped to two lines so
+  one long name cannot make every card in its row tall. The locker line is never
+  clipped: it is how somebody finds the thing.
+
 - **Muted text on the USB kiosk and in guides was not muted.** Both named a
   `--textmuted` variable this app has never defined, so the browser dropped the
   declaration and the hints, subtitles and locker lines rendered at full