Add Scripps Sandbox kiosk v2

[ScriptsSandbox]

What changed

• adds the new Scripps Sandbox touchscreen kiosk under Kiosk-v2/, leaving the existing Python application untouched
• adds a Raspberry Pi serial-to-WebSocket bridge for the existing ESP32/PN532 reader
• adds reader reconnect, duplicate-read suppression, simulation support, systemd guidance, and privacy-safe logging
• includes the agreed production specification for presence, staff roles, trainer authorizations, calendar behavior, offline handling, migration, and retention

Why

This creates an isolated, reversible path to validate the new kiosk on the existing Raspberry Pi without interrupting the current check-in workflow or changing the waiver source.

Validation

• production web build passed before the source was copied into this branch
• five scanner protocol tests pass
• simulated health, WebSocket card delivery, duplicate suppression, client cleanup, and graceful shutdown were exercised end to end
• staged content was checked for whitespace errors and common secret patterns

Deployment impact

No existing files or startup configuration are changed by this pull request. The new kiosk can be installed alongside the current application and activated only after a controlled hardware test.