feat(fusion_clock): PIN kiosk — polished photo-tile + PIN clock (opt-in)

A proper shared-device PIN kiosk for clients who don't want NFC: photo-tile grid
(+search) -> tap -> PIN (or first-use create) -> optional master-gated selfie ->
clock, in the NFC kiosk's dark glass + brand-gradient style. Built as an Odoo 19
Interaction; new pin_kiosk.scss (scoped); reworked clock_kiosk.py
(search +avatar/has_pin, verify_pin needs_setup, set_pin, clock via kiosk location).
Drops the redundant kiosk_pin_required (PIN always required); relabels the company
kiosk location; adds a PIN-kiosk app icon. Opt-in via enable_kiosk (off by default).
HttpCase tests added. Bump 19.0.4.0.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fusion_clock/models/res_config_settings.py

@@ -151,11 +151,6 @@ class ResConfigSettings(models.TransientModel):
         default=False,
         help="Allow employees to clock in/out from a shared device using their PIN code.",
     )
-    fclk_kiosk_pin_required = fields.Boolean(
-        string='Require PIN for Kiosk',
-        default=True,
-        help="Require employees to enter a PIN when using kiosk mode.",
-    )
     fclk_enable_correction_requests = fields.Boolean(
         string='Enable Correction Requests',
         default=True,
@@ -276,7 +271,6 @@ class ResConfigSettings(models.TransientModel):
         ('fclk_enable_ip_fallback', 'fusion_clock.enable_ip_fallback', True),
         ('fclk_enable_photo_verification', 'fusion_clock.enable_photo_verification', False),
         ('fclk_enable_kiosk', 'fusion_clock.enable_kiosk', False),
-        ('fclk_kiosk_pin_required', 'fusion_clock.kiosk_pin_required', True),
         ('fclk_enable_correction_requests', 'fusion_clock.enable_correction_requests', True),
         ('fclk_enable_sounds', 'fusion_clock.enable_sounds', True),
         ('fclk_auto_generate_reports', 'fusion_clock.auto_generate_reports', True),