Adds /fusion_clock/kiosk/nfc/enroll (jsonrpc, auth=user) that validates the enroll password, normalises the card UID, checks for duplicate assignments, writes x_fclk_nfc_card_uid, and creates a card_enrollment activity log entry. 4 new tests; 21 total passing. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>