Kiosk Lock

Lock the kiosk screen. Does NOT close task or shop time entries.

Unconditional by design: does not require a currently-valid kiosk session. A hard dependency here previously 401'd before clear_kiosk_cookie() ran whenever the session looked invalid (already ended, expired, or a transient lookup failure) - leaving a still-valid cookie in the browser to outrank the next WorkOS login. end_kiosk_session() is a no-op if there's nothing to end; clear_kiosk_cookie() is always safe to call.