Karta Kiosk Backend

Kiosk API surface for ECC-authenticated EMV cards. See /api/kiosk/* for device-authenticated endpoints. Admin dashboard ships in a later slice.