Add Employee Timeclock feature with kiosk, attendance report, and payroll CSV export

- New EmployeeClockEntry entity (facility-level attendance, separate from job time entries)
- KioskPin added to ApplicationUser; TimeclockKioskToken added to Company
- TimeclockController: clock in/out, who's in, 14-day history, manager edit/delete,
  tablet kiosk with device-cookie auth, PIN management via Users edit page
- Kiosk UI: employee tile grid + 4-digit PIN pad + auto-detect clock-in vs clock-out
- Attendance report at /Reports/Attendance with weekly subtotal rows
- Payroll CSV export at /Reports/AttendanceCsv (flat, one row per segment)
- AllowCustomFormulas wired through PlatformSubscriptionController + subscription views
- Fix soft-delete bug on CustomItemTemplate (missing HasQueryFilter in OnModelCreating)
- Help article (Help/Timeclock.cshtml) and AI knowledge base updated
- Migrations: AddEmployeeTimeclock, AddTimeclockKioskToken

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Web/Helpers/HelpKnowledgeBase.cs

@@ -1435,6 +1435,31 @@ public static class HelpKnowledgeBase
         - Flat panel: fields l_in/w_in → l_in * w_in / 144 * rate
         Walkthrough: first time opening Custom Formulas tab with no templates triggers a 7-step guided tour automatically; also accessible via "How it works" button
         Help article: Help → Custom Formula Item Templates
+
+        ---
+
+        **Employee Timeclock (/Timeclock):**
+        Facility-level clock in/out for employees — tracks when workers arrive and leave, separate from Job Time Entries which log hours against a specific job.
+        Multiple punches per day fully supported (clock out for lunch, clock in again, clock out, etc.); each segment tracked separately with its own in/out and hours.
+        Only constraint: you cannot clock in while already clocked in — clock out first.
+
+        Dashboard (/Timeclock):
+        - Your clock status card: shows "Clocked In" (with time) or "Clocked Out"; one-click Clock In / Clock Out buttons
+        - Who's In table: all employees currently clocked in, with elapsed time; refreshes every 60 seconds
+        - My Recent History: last 14 days of your own punch segments grouped by day with daily totals
+        - Manager section (CompanyAdmin and Manager roles only): Team History with date-range filter; edit/delete any entry for any employee in the company
+
+        Editing entries: Only Managers and Company Admins can edit or delete clock entries. Workers cannot edit their own entries — all corrections must go through a manager.
+
+        Kiosk mode (/Timeclock/Kiosk):
+        A shared shop tablet page that does not require login. Employees tap their name tile → enter 4-digit PIN → system automatically clocks in (if out) or clocks out (if in). Confirmation screen shows time, segment hours, and today's running total. Returns to employee grid after 4 seconds.
+        Activation: Manager navigates to /Timeclock/Kiosk/Activate — generates device cookie; kiosk then runs without login. Re-visiting /Kiosk/Activate revokes the old device and re-activates the current one.
+
+        PIN management: on a user's Edit page (Settings → Users → Edit User) there is a "Timeclock Kiosk PIN" section. Enter a 4-digit PIN and click "Set PIN" to enable that employee on the kiosk. Click "Clear" to disable them.
+
+        Attendance Report (/Reports/Attendance): shows daily punch detail per employee with date-range filter. Each employee card groups segments by day (with day totals) and by ISO week (with weekly subtotal rows). Managers see all employees; workers see their own history only.
+        CSV Export: "Export CSV (Payroll)" button downloads a flat CSV with one row per punch segment — columns: Employee Name, Date, Day of Week, Clock In, Clock Out, Segment Hours, Day Total Hours, Week Total Hours, Notes. Suitable for import into payroll software or handoff to a payroll provider.
+        Help article: Help → Timeclock
         """;
 
 }