a6546ac858
3-sub-phase TDD plan executing the spec at docs/superpowers/specs/2026-05-22-shopfloor-pin-gate-design.md: - Phase 6.1 (Backend): res.users PIN fields + PBKDF2-SHA256 hash helpers, 5 /fp/tablet/* endpoints (tiles/unlock/set_pin/reset_pin_for/ ping), per-user lockout after 5 failures, station roster + idle-override fields, ir.config_parameter defaults, Preferences Set/Change PIN button, manager Reset PIN header button. Tests cover hash safety, lockout edge cases, manager-only enforcement, tile filtering. - Phase 6.2 (Frontend lock screen): tech_store + activity_tracker OWL services, FpPinPad + FpIdleWarning + FpPinSetup components, FpTabletLock outer wrapper, wire into Landing/Workspace/Manager Dashboard with Hand-Off button injection. - Phase 6.3 (Audit propagation): fpRpc wrapper auto-injects tablet_tech_id, env_for_tablet_tech server helper, all action endpoints (workspace + shopfloor + manager) accept the kwarg and rebind env via env.with_user() so writes carry the right operator. Each sub-phase ships independently per spec §9. Plan follows the established workflow: write tests + commit, verify on entech (local docker doesn't have fusion_plating mounted). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>