feat(fusion_clock): NFC kiosk — enrollment, manager page, sounds, lock, profile photos

Kiosk work across this session (19.0.3.6.0 -> 19.0.3.10.0):
- Program-from-unknown-tap: amber prompt -> Manager PIN -> pick/create employee
  -> binds the captured UID (no re-tap). Reassign moves a card between employees.
- Manager page (gear, when unlocked): search employees + tag status; assign/re-tag,
  clear tag, archive employee, + new employee. Server-gated by the enroll password.
- Screen lock: kiosk starts locked (tap-only); Unlock -> Manager PIN, Lock button;
  PIN remembered for the session so the gear never re-prompts.
- Sounds: pleasant + loud sine chimes (rising in / descending out) + a low "denied"
  tone for wrong/unknown taps. Gated by fusion_clock.enable_sounds.
- Guided profile-photo capture for employees with no picture (clock-in or enroll):
  live camera + oval face guide -> capture -> preview -> save to hr.employee.
- PIN no longer re-renders per digit; centered result card; 12h time; clock-out shows
  "Worked Xh Ym this shift"; modern clock idle icon; faster animations/result timers;
  session keep-alive so the kiosk login never expires.
- New endpoints: create_employee, clear_tag, delete_employee (archive), verify_pin,
  save_profile_photo; enroll gains force-reassign.
- Docs: fusion_clock is now developed in Claude Code (dropped Cursor references).

Spec/plan under fusion_clock/docs/superpowers/. Deployed live on entech
(odoo-entech / LXC 111 on pve-worker5), v19.0.3.10.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fusion_clock/views/kiosk_nfc_templates.xml

@@ -20,6 +20,7 @@
                  t-att-data-photo-required="'1' if photo_required else '0'"
                  t-att-data-debug-enabled="'1' if debug_enabled else '0'"
                  t-att-data-location-configured="'1' if location_configured else '0'"
+                 t-att-data-sounds-enabled="'1' if sounds_enabled else '0'"
                  t-att-data-company-logo-url="company_logo_url or ''">
 
                 <!-- Company logo (also drives the dominant-hue palette via JS) -->
@@ -38,6 +39,8 @@
                     <span t-if="location_configured">Clock at: <t t-esc="location_name"/></span>
                     <span t-else="" style="color:#d9374e">⚠ No location configured</span>
                 </div>
+                <button class="nfc-kiosk__lock" id="nfc_lock_btn" title="Lock screen">🔒</button>
+                <button class="nfc-kiosk__lock" id="nfc_unlock_btn" title="Unlock (manager PIN)">🔓</button>
                 <button class="nfc-kiosk__settings" id="nfc_settings_btn" title="Enroll Mode">⚙</button>
 
                 <!-- Dynamic state container (JS swaps inner HTML based on state) -->