fix(tablet): ACL, loading hang, timer offset + FP-tz clock

Four fixes shipped together — all surfaced during tablet UX walkthrough
on entech.

1. sale.order ACL on step completion
   Technicians hit "Access Denied... sale.order" when starting/finishing
   any step. _fp_check_receiving_gate + the serial-promotion helpers +
   _fp_resolve_contract_review_part read step.job_id.sale_order_id (and
   sale_order_line_ids) without sudo. Per Rule 13m, denormalized cross-
   module reads in tablet controllers must sudo() the source recordset.

2. Workspace stuck on "Loading Job Workspace…" after Hand Off + relogin
   Action params aren't URL-encoded, so the workspace remounts with
   jobId=null. refresh() exited early, state.data stayed null, "Loading"
   shown indefinitely. onMounted now redirects to the plant kanban
   when jobId is null or the initial load returns no data.

3. 4-hour timer offset on active steps
   workspace_controller used fp_format() to serialize date_started —
   which converts naive UTC to user tz wall time first. JS then
   appended 'Z' and parsed as UTC, so timer was offset by the user's
   tz (4h on EDT). Switched to fp_isoformat_utc() (proper +00:00 ISO)
   and dropped the Z-append in formatActiveStepElapsed +
   isActiveStepOvertime.

4. Lock-screen clock follows FP regional setting
   tablet_lock.js used d.getHours() / d.toLocaleDateString() — browser
   tz. Now /fp/tablet/tiles returns tz_name (fp_user_tz resolution:
   user.tz → company.x_fc_default_tz → UTC) and the formatters use
   Intl.DateTimeFormat with the explicit timeZone option. plant_overview
   now consumes server_time (already fp_format'd) instead of toLocaleTime
   String. Same chain Odoo backend uses, so PDF / view / tablet all
   agree on what time it is.

Versions: fusion_plating_jobs 19.0.10.30.0,
fusion_plating_shopfloor 19.0.33.1.12.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_plating/fusion_plating_shopfloor/controllers/tablet_controller.py

@@ -16,6 +16,7 @@ import logging
 from datetime import timedelta
 
 from odoo import _, fields, http
+from odoo.addons.fusion_plating.models.fp_tz import fp_user_tz
 from odoo.exceptions import AccessDenied, UserError
 from odoo.http import request
 
@@ -455,12 +456,18 @@ class FpTabletController(http.Controller):
             raise_if_not_found=False,
         )
         kiosk_uid = kiosk.id if kiosk else None
+        # tz_name — resolved per fp_tz.fp_user_tz (kiosk user.tz → company
+        # x_fc_default_tz → UTC). Frontend uses Intl.DateTimeFormat with
+        # this tz so the lock-screen clock follows the FP regional
+        # setting, not the iPad's system tz (caught 2026-05-25 when the
+        # workspace timer-offset bug surfaced the broader pattern).
         return {
             'ok': True,
             'company': _lock_company_payload(request.env),
             'tiles': tiles,
             'kiosk_uid': kiosk_uid,
             'current_uid': request.env.uid,
+            'tz_name': str(fp_user_tz(request.env)),
         }
 
     # ======================================================================

fusion_plating/fusion_plating_shopfloor/controllers/workspace_controller.py

@@ -20,7 +20,7 @@ Companion plan: docs/superpowers/plans/2026-05-22-shopfloor-tablet-redesign-plan
 import logging
 
 from odoo import fields, http
-from odoo.addons.fusion_plating.models.fp_tz import fp_format
+from odoo.addons.fusion_plating.models.fp_tz import fp_format, fp_isoformat_utc
 from odoo.exceptions import UserError
 from odoo.http import request
 
@@ -81,9 +81,12 @@ class FpWorkspaceController(http.Controller):
                 'work_centre_name': step.work_centre_id.name or '',
                 'duration_actual': step.duration_actual or 0,
                 'duration_expected': step.duration_expected or 0,
-                'date_started_iso': fp_format(
-                    env, step.date_started, fmt='%Y-%m-%d %H:%M:%S',
-                ) if step.date_started else '',
+                # fp_isoformat_utc — preserves UTC with explicit +00:00
+                # offset so the JS timer parses it as UTC (not local wall
+                # time). fp_format would convert to user tz first, then
+                # the JS would re-interpret that wall time as UTC and
+                # offset the timer by the user's tz offset (4h on EDT).
+                'date_started_iso': fp_isoformat_utc(step.date_started),
                 'instructions': step.instructions or '',
                 'thickness_target': step.thickness_target or 0,
                 'thickness_uom': step.thickness_uom or '',