fix(shopfloor): lock_session resolves kiosk login via xmlid

The kiosk_login in /fp/tablet/lock_session was hardcoded to the
data XML's original value ('fp_tablet_kiosk@enplating.local'). The
data record is noupdate='1', so admins can (and on entech, did)
rename the kiosk user on the form for memorability — the rename
persists through -u, but the hardcoded string in the controller
silently breaks the re-auth-as-kiosk path.

Fix: resolve the kiosk login dynamically via env.ref of the xmlid
'fusion_plating_shopfloor.user_fp_tablet_kiosk'. Robust against any
future rename. CLAUDE.md updated to make 'identify by xmlid, never
by login string' an explicit convention for the tablet flow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_plating/fusion_plating_shopfloor/controllers/tablet_controller.py

@@ -323,10 +323,25 @@ class FpTabletController(http.Controller):
         # Destroy the tech session
         request.session.logout(keep_db=True)
 
-        # Re-authenticate as the kiosk user. Credential comes from
+        # Re-authenticate as the kiosk user. Resolve the login via xmlid
+        # so admins can rename the kiosk user (e.g. for memorability) on
+        # the user form without breaking lock-back. Password comes from
         # ir.config_parameter (auto-generated on first install in
-        # post-migrate.py).
-        kiosk_login = 'fp_tablet_kiosk@enplating.local'
+        # post-migrate.py; must be kept in sync with the user-record
+        # password by anyone who resets it on the user form).
+        kiosk_user = env.ref(
+            'fusion_plating_shopfloor.user_fp_tablet_kiosk',
+            raise_if_not_found=False,
+        )
+        kiosk_login = kiosk_user.sudo().login if kiosk_user else None
+        if not kiosk_login:
+            _logger.error(
+                'fusion_plating_shopfloor.user_fp_tablet_kiosk xmlid not '
+                'found; cannot re-auth tablet as kiosk. The browser will '
+                'need manual login.'
+            )
+            return {'ok': True, 'locked_at': now.isoformat(),
+                    'needs_kiosk_relogin': True}
         kiosk_password = env['ir.config_parameter'].sudo().get_param(
             'fp.tablet.kiosk_password', ''
         )