Add Timeclock settings tab in Company Settings with multi-kiosk support

Settings tab (Company Settings > Timeclock):
- Enable/disable timeclock toggle (hides nav link and attendance report when off)
- Allow multiple clock-ins per day toggle
- Auto clock-out after X hours (auto-closes forgotten open entries on next punch)
- Kiosk devices table: lists activated tablets with name, activated date, last seen;
  Deactivate button removes that device's access immediately

Multi-kiosk support (replaces single TimeclockKioskToken on Company):
- New TimeclockKioskDevice entity (one row per tablet, unique token, DeviceName, LastSeenAt)
- KioskActivate GET shows a form for optional device name before activating
- KioskDeactivate POST accepts device ID, deletes specific row (not all devices)
- Kiosk validation (Kiosk, KioskEmployees, KioskPunch) queries device table with
  ignoreQueryFilters since no user is logged in on kiosk requests
- LastSeenAt updated on each Kiosk page load

Enforcement:
- ClockIn and KioskPunch both auto-close stale entries if AutoClockOutHours is set
- ClockIn and KioskPunch both block second same-day punch if AllowMultiplePunches=false
- TimeclockEnabled=false hides nav link (SubscriptionMiddleware sets Items key) and
  returns Forbid on kiosk punch
- Migration: AddTimeclockSettings (adds 3 columns to Companies, new TimeclockKioskDevices table)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Infrastructure/Data/ApplicationDbContext.cs

@@ -382,6 +382,9 @@ public class ApplicationDbContext : IdentityDbContext<ApplicationUser>, IDataPro
     /// <summary>Facility-level clock-in/clock-out entries per employee; tenant-filtered with soft delete. Multiple entries per day are supported (lunch breaks, etc.).</summary>
     public DbSet<EmployeeClockEntry> EmployeeClockEntries { get; set; }
 
+    /// <summary>One row per activated kiosk tablet per company. Token stored in device cookie; delete row to revoke a device.</summary>
+    public DbSet<TimeclockKioskDevice> TimeclockKioskDevices { get; set; }
+
     /// <summary>
     /// Platform-wide audit log capturing who changed what and when, across all tenants.
     /// No global query filter — SuperAdmin controllers query this directly.
@@ -793,6 +796,14 @@ modelBuilder.Entity<ReworkRecord>().HasQueryFilter(e =>
         modelBuilder.Entity<EmployeeClockEntry>()
             .HasIndex(c => new { c.CompanyId, c.ClockInTime });
 
+        // Timeclock kiosk devices — one row per activated tablet per company
+        modelBuilder.Entity<TimeclockKioskDevice>().HasQueryFilter(d =>
+            !d.IsDeleted && (IsPlatformAdmin || d.CompanyId == CurrentCompanyId));
+        modelBuilder.Entity<TimeclockKioskDevice>()
+            .HasIndex(d => d.Token).IsUnique();
+        modelBuilder.Entity<TimeclockKioskDevice>()
+            .HasIndex(d => d.CompanyId);
+
         // Account self-referencing hierarchy
         modelBuilder.Entity<Account>()
             .HasOne(a => a.ParentAccount)