DoughBoss 2.33.2 RC1

Adds the hidden, protected /catering-kitchen/ production portal while preserving /kitchen/?screen=catering. Staff portals use WordPress authentication, DoughBoss roles, shop scope, REST nonces, no-index/no-cache headers and anti-framing protection. Public customer navigation remains unchanged. CI and local release validation are green.