fix: camera button (📷) intercepted by kiosk native btnSettings overlay

- Kiosk (Android): btnSettings was positioned top|end with alpha=0.12,
  sitting invisibly on top of the HTML scan button in the webapp header.
  Moved to bottom|end (marginBottom=80dp, alpha=0.28) so it never
  overlaps the header. Kiosk versionCode 15→16, versionName 1.7.15.
- Web (Android Chrome/Brave): pointerleave fired before pointerup when
  finger drifted, cancelling the long-press timer and letting a synthetic
  click bubble to an unintended handler. Fixed with setPointerCapture +
  preventDefault + replaced pointerleave with pointercancel. Added
  touch-action:manipulation to .header-scan-btn CSS.

assets/js/app.js

@@ -14276,6 +14276,8 @@ function initSpesaMode() {
     if (!btn) return;
 
     btn.addEventListener('pointerdown', (e) => {
+        e.preventDefault(); // prevent browser-generated synthetic click + 300ms delay
+        btn.setPointerCapture(e.pointerId); // ensure pointerup always fires on this element even if finger drifts
         _longPressTimer = setTimeout(() => {
             _longPressTimer = null;
             startSpesaMode();
@@ -14289,12 +14291,14 @@ function initSpesaMode() {
             showPage('scan');
         }
     });
-    btn.addEventListener('pointerleave', () => {
+    btn.addEventListener('pointercancel', () => {
+        // OS cancelled gesture (e.g. home swipe) — discard timer, do nothing
         if (_longPressTimer) {
             clearTimeout(_longPressTimer);
             _longPressTimer = null;
         }
     });
+    // Note: no pointerleave handler needed — setPointerCapture prevents it from firing during touch
 }
 
 function startSpesaMode() {