printedparts stage 10: closeout - lab guide rewritten from the real build

The lab is now a build-along mirroring what actually happened: ten
stages, each with the goal, the divergences, a see-it-work check, and
the errors genuinely hit while building (empty Migration error from a
broken model import, the migration-guard KeyError, the missing Lucide
icon, nested-app-context test writes, Decimal sums, and the authz
sweep catching the deliberately open kiosk take). That last one gets
its explicit EXEMPT_ENDPOINTS entry with a pointer to the decision
record - the net stays, the exception is reviewable. Full suite: 993
backend tests, 49 vitest, frontend build, naming hook, all green.

tests/test_core/test_authz.py

@@ -45,7 +45,12 @@ EXEMPT_BLUEPRINTS = {'auth', 'collector', 'setup'}
 #     shape as the exempt collector blueprint; the geenforce admin endpoints in
 #     the same blueprint are JWT+permission gated and ARE swept.
 EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
-                    'geenforce.post_report'}
+                    'geenforce.post_report',
+                    # Deliberately open kiosk write: decrement-only,
+                    # badge-attributed server-side. Decision record in
+                    # docs/proposals/printedparts-plugin.md; justification in
+                    # the plugin README.
+                    'printedparts.kiosk_take'}
 
 
 @pytest.fixture(autouse=True)