Add Timeclock settings tab in Company Settings with multi-kiosk support

Settings tab (Company Settings > Timeclock):
- Enable/disable timeclock toggle (hides nav link and attendance report when off)
- Allow multiple clock-ins per day toggle
- Auto clock-out after X hours (auto-closes forgotten open entries on next punch)
- Kiosk devices table: lists activated tablets with name, activated date, last seen;
  Deactivate button removes that device's access immediately

Multi-kiosk support (replaces single TimeclockKioskToken on Company):
- New TimeclockKioskDevice entity (one row per tablet, unique token, DeviceName, LastSeenAt)
- KioskActivate GET shows a form for optional device name before activating
- KioskDeactivate POST accepts device ID, deletes specific row (not all devices)
- Kiosk validation (Kiosk, KioskEmployees, KioskPunch) queries device table with
  ignoreQueryFilters since no user is logged in on kiosk requests
- LastSeenAt updated on each Kiosk page load

Enforcement:
- ClockIn and KioskPunch both auto-close stale entries if AutoClockOutHours is set
- ClockIn and KioskPunch both block second same-day punch if AllowMultiplePunches=false
- TimeclockEnabled=false hides nav link (SubscriptionMiddleware sets Items key) and
  returns Forbid on kiosk punch
- Migration: AddTimeclockSettings (adds 3 columns to Companies, new TimeclockKioskDevices table)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Infrastructure/Repositories/UnitOfWork.cs

@@ -125,6 +125,7 @@ public class UnitOfWork : IUnitOfWork
 
     // Employee Timeclock
     private IRepository<EmployeeClockEntry>? _employeeClockEntries;
+    private IRepository<TimeclockKioskDevice>? _timeclockKioskDevices;
 
     // Custom Formula Templates
     private IRepository<CustomItemTemplate>? _customItemTemplates;
@@ -467,6 +468,10 @@ public class UnitOfWork : IUnitOfWork
     public IRepository<EmployeeClockEntry> EmployeeClockEntries =>
         _employeeClockEntries ??= new Repository<EmployeeClockEntry>(_context);
 
+    /// <summary>Repository for <see cref="TimeclockKioskDevice"/> activated tablet records; one row per device. Delete a row to revoke that device's access.</summary>
+    public IRepository<TimeclockKioskDevice> TimeclockKioskDevices =>
+        _timeclockKioskDevices ??= new Repository<TimeclockKioskDevice>(_context);
+
     /// <summary>Repository for <see cref="CustomItemTemplate"/> per-company reusable NCalc pricing formula templates; tenant-filtered with soft delete.</summary>
     public IRepository<CustomItemTemplate> CustomItemTemplates =>
         _customItemTemplates ??= new Repository<CustomItemTemplate>(_context);