Add Timeclock settings tab in Company Settings with multi-kiosk support

Settings tab (Company Settings > Timeclock):
- Enable/disable timeclock toggle (hides nav link and attendance report when off)
- Allow multiple clock-ins per day toggle
- Auto clock-out after X hours (auto-closes forgotten open entries on next punch)
- Kiosk devices table: lists activated tablets with name, activated date, last seen;
  Deactivate button removes that device's access immediately

Multi-kiosk support (replaces single TimeclockKioskToken on Company):
- New TimeclockKioskDevice entity (one row per tablet, unique token, DeviceName, LastSeenAt)
- KioskActivate GET shows a form for optional device name before activating
- KioskDeactivate POST accepts device ID, deletes specific row (not all devices)
- Kiosk validation (Kiosk, KioskEmployees, KioskPunch) queries device table with
  ignoreQueryFilters since no user is logged in on kiosk requests
- LastSeenAt updated on each Kiosk page load

Enforcement:
- ClockIn and KioskPunch both auto-close stale entries if AutoClockOutHours is set
- ClockIn and KioskPunch both block second same-day punch if AllowMultiplePunches=false
- TimeclockEnabled=false hides nav link (SubscriptionMiddleware sets Items key) and
  returns Forbid on kiosk punch
- Migration: AddTimeclockSettings (adds 3 columns to Companies, new TimeclockKioskDevices table)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Core/Entities/Company.cs

@@ -133,11 +133,14 @@ public class Company : BaseEntity
     /// </summary>
     public string? KioskActivationToken { get; set; }
 
-    /// <summary>
-    /// Device activation token for the Timeclock kiosk tablet.
-    /// Null = timeclock kiosk not activated on any device.
-    /// </summary>
-    public string? TimeclockKioskToken { get; set; }
+    /// <summary>Timeclock feature enabled for this company. When false, the nav link, dashboard, and reports are hidden.</summary>
+    public bool TimeclockEnabled { get; set; } = true;
+
+    /// <summary>When true, employees can clock in/out multiple times per day (lunch breaks, etc.). When false, only one in/out pair is allowed per day.</summary>
+    public bool TimeclockAllowMultiplePunchesPerDay { get; set; } = true;
+
+    /// <summary>If set, any open clock entry older than this many hours is automatically closed on the next clock-in. Null = no auto clock-out.</summary>
+    public int? TimeclockAutoClockOutHours { get; set; }
 
     // Navigation Properties
     public virtual ICollection<ApplicationUser> Users { get; set; } = new List<ApplicationUser>();

src/PowderCoating.Core/Entities/TimeclockKioskDevice.cs

@@ -0,0 +1,22 @@
+namespace PowderCoating.Core.Entities;
+
+/// <summary>
+/// Represents an activated shop-floor kiosk tablet for the timeclock.
+/// One row per device; multiple rows per company are supported so shops can have
+/// tablets at multiple entry points. The <see cref="Token"/> is stored in a
+/// device-specific cookie and validated on every kiosk request.
+/// </summary>
+public class TimeclockKioskDevice : BaseEntity
+{
+    /// <summary>Human-readable label for this device (e.g. "Front Entrance Tablet").</summary>
+    public string? DeviceName { get; set; }
+
+    /// <summary>Cryptographically random token written to the device cookie on activation. Revoke by deleting this row.</summary>
+    public string Token { get; set; } = string.Empty;
+
+    /// <summary>UTC timestamp when a manager activated this device.</summary>
+    public DateTime ActivatedAt { get; set; }
+
+    /// <summary>UTC timestamp of the most recent kiosk request from this device; null if never used after activation.</summary>
+    public DateTime? LastSeenAt { get; set; }
+}