Check-in kiosk

Device-scoped kiosk (PWA). Phase 1 adds QR scan auto check-in, tardy marking, overdue-balance and policy gating, and per-zone display — authenticated with a device token, never a shared "checkin" login (a named incumbent anti-pattern).