feat(fusion_clock): kiosk app + Kiosk Operator role, full-screen PWA, app-integrated permissions

- PWA manifest on the NFC kiosk page so it installs as a full-screen
  home-screen app (Chrome "Install" / Safari "Add to Home Screen").
- Dedicated "Kiosk Operator" permission + gated "Fusion Clock Kiosk"
  top-level app (act_url -> /fusion_clock/kiosk/nfc). Kiosk controllers
  accept Manager OR Kiosk Operator; all kiosk data ops already run sudo.
- Fix 403: read the company kiosk location via sudo on page-load and tap
  (Kiosk Operator has no fusion.clock.location ACL).
- Odoo 19 permissions UX: ir.module.category + res.groups.privilege so
  User/Team Lead/Manager and Kiosk Operator appear as application-access
  dropdowns on the user form (no developer mode). Short group display names.
- Docs: note res.groups.privilege as the Odoo 19 category_id replacement.

Deployed live to entech (odoo-entech / LXC 111 on pve-worker5). v19.0.3.6.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fusion_clock/views/clock_menus.xml

@@ -8,6 +8,22 @@
               sequence="45"
               groups="group_fusion_clock_user"/>
 
+    <!-- Dedicated kiosk app: a separate top-level icon (same artwork) that opens
+         the NFC kiosk. Gated to Kiosk Operator so shared tablet accounts see ONLY
+         this app, not the full Fusion Clock backend. -->
+    <record id="action_fusion_clock_kiosk_nfc" model="ir.actions.act_url">
+        <field name="name">Fusion Clock Kiosk</field>
+        <field name="url">/fusion_clock/kiosk/nfc</field>
+        <field name="target">self</field>
+    </record>
+
+    <menuitem id="menu_fusion_clock_kiosk_app_root"
+              name="Fusion Clock Kiosk"
+              web_icon="fusion_clock,static/description/icon.png"
+              action="action_fusion_clock_kiosk_nfc"
+              sequence="46"
+              groups="group_fusion_clock_kiosk_app"/>
+
     <!-- Dashboard -->
     <menuitem id="menu_fusion_clock_dashboard"
               name="Dashboard"