2d675720b7
Get-ShopdbConfig required both BaseUrl AND ApiToken, so a token-less kiosk (authorized by the server's IP allowlist) got a null config and never ran. Now BaseUrl alone is a valid config; X-API-Key is sent only when a token is present (New-ShopdbAuthHeaders), so token-authorized sites are unchanged and vaulted-network sites need no per-PC token.