Add Employee Timeclock feature with kiosk, attendance report, and payroll CSV export

- New EmployeeClockEntry entity (facility-level attendance, separate from job time entries)
- KioskPin added to ApplicationUser; TimeclockKioskToken added to Company
- TimeclockController: clock in/out, who's in, 14-day history, manager edit/delete,
  tablet kiosk with device-cookie auth, PIN management via Users edit page
- Kiosk UI: employee tile grid + 4-digit PIN pad + auto-detect clock-in vs clock-out
- Attendance report at /Reports/Attendance with weekly subtotal rows
- Payroll CSV export at /Reports/AttendanceCsv (flat, one row per segment)
- AllowCustomFormulas wired through PlatformSubscriptionController + subscription views
- Fix soft-delete bug on CustomItemTemplate (missing HasQueryFilter in OnModelCreating)
- Help article (Help/Timeclock.cshtml) and AI knowledge base updated
- Migrations: AddEmployeeTimeclock, AddTimeclockKioskToken

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Web/Middleware/SubscriptionMiddleware.cs

@@ -93,9 +93,10 @@ public class SubscriptionMiddleware
         // SuperAdmins get all features but still need the feature flags set for views
         if (context.User.IsInRole(AppConstants.Roles.SuperAdmin))
         {
-            context.Items["AllowOnlinePayments"] = true;
-            context.Items["AllowAccounting"]     = true;
-            context.Items["AllowSms"]            = true;
+            context.Items["AllowOnlinePayments"]  = true;
+            context.Items["AllowAccounting"]      = true;
+            context.Items["AllowSms"]             = true;
+            context.Items["AllowCustomFormulas"]  = true;
             await _next(context);
             return;
         }
@@ -143,8 +144,10 @@ public class SubscriptionMiddleware
             context.Items["AllowAccounting"]     = company.IsComped
                 || (company.AccountingOverride ?? (planConfig?.AllowAccounting ?? false));
             // SMS: comped gets it; admin force-disable beats everything else; then plan; then company opt-in
-            context.Items["AllowSms"]            = company.IsComped
+            context.Items["AllowSms"]           = company.IsComped
                 || (!company.SmsDisabledByAdmin && (planConfig?.AllowSms ?? false) && company.SmsEnabled);
+            context.Items["AllowCustomFormulas"] = company.IsComped
+                || (planConfig?.AllowCustomFormulas ?? false);
 
             if (company.IsComped)
             {