Lock down the station kiosk window

On Windows stations the kiosk ran inside Edge, so operators saw translate prompts, Copilot, image search buttons and could open tabs with Ctrl+T.

• Added a dedicated kiosk window on Windows and macOS: full screen, no tabs, no address bar, no browser shortcuts, no translate prompt, no sidebar; navigation is limited to the station itself and the window closes when the station stops. Windows needs the WebView2 runtime, which current Windows 10 and 11 editions include.
• Updated the Linux kiosk to run on Chromium only, with translate, autofill and spellcheck prompts turned off and a per-launch profile that is cleaned up automatically. Firefox, Edge and Brave are no longer launched on Linux.
• Added the TofuPilot icon to the kiosk window on every platform.