Add od-cfg-persist runbook + od-cfg-acl script

Persist Open Dental's 'Do not show this window on startup' by making
FreeDentalConfig.xml writable:
- Option A: one-time elevated save
- Option B (preferred): grant Users Modify via well-known SID S-1-5-32-545
- od-cfg-acl.ps1 auto-resolves 64/32-bit install path, iex-safe conventions
- Security note on reversible MySQL password in the config; limited user / Middle Tier
- Cites OD manual freedentalconfig.html / choosedatabase.html

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/od-cfg-acl.ps1

@@ -0,0 +1,64 @@
+<#
+.SYNOPSIS
+  Grant the built-in Users group Modify on Open Dental's FreeDentalConfig.xml
+  so the "Do not show this window on startup" setting persists for standard
+  users.
+
+.DESCRIPTION
+  Open Dental stores the Choose Database window's "do not show on startup"
+  setting in FreeDentalConfig.xml in the install directory. Standard (non-admin)
+  users lack write permission there, so the checkbox never saves and the window
+  returns on every launch. This grants the built-in Users group Modify on that
+  one file, using the well-known SID (locale-independent).
+
+  Auto-resolves the install directory across 64-bit / 32-bit Program Files;
+  fails clearly if FreeDentalConfig.xml isn't found in either.
+
+.NOTES
+  Run via:  irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/od-cfg-acl.ps1 | iex
+  Referenced by od-cfg-persist.md, Option B.
+
+  SECURITY: on direct-connection setups FreeDentalConfig.xml also holds the
+  MySQL password (obfuscated but reversible). Widening write access here does
+  not change that exposure, but prefer a limited MySQL user over root for
+  workstation connections, and Middle Tier as the long-term fix that removes
+  per-workstation DB credentials entirely. See the runbook's security note.
+#>
+
+$ErrorActionPreference = 'Stop'
+
+# --- Admin check (do not rely on #Requires under iex) ---
+$isAdmin = ([Security.Principal.WindowsPrincipal] `
+    [Security.Principal.WindowsIdentity]::GetCurrent()
+  ).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
+if (-not $isAdmin) {
+    Write-Warning 'This script needs an elevated PowerShell session. Re-run as Administrator.'
+    return
+}
+
+Write-Host '== Open Dental: make FreeDentalConfig.xml writable by Users ==' -ForegroundColor Cyan
+
+# --- Resolve install path across 64-bit / 32-bit Program Files ---
+$bases = @(${env:ProgramFiles(x86)}, $env:ProgramFiles) | Where-Object { $_ }
+$candidates = $bases | ForEach-Object { Join-Path $_ 'Open Dental\FreeDentalConfig.xml' }
+$configPath = $candidates | Where-Object { Test-Path $_ } | Select-Object -First 1
+if (-not $configPath) {
+    Write-Warning "FreeDentalConfig.xml not found. Checked:`n  $($candidates -join "`n  ")"
+    Write-Warning 'If Open Dental is installed elsewhere, grant Users Modify on that copy manually.'
+    return
+}
+
+Write-Host "Found: $configPath" -ForegroundColor Green
+Write-Host 'About to grant the built-in Users group (S-1-5-32-545) Modify on this file.' -ForegroundColor Yellow
+if ((Read-Host 'Proceed? (y/N)') -ne 'y') {
+    Write-Host 'Aborted. No changes made.'
+    return
+}
+
+# --- Grant Modify to Users via well-known SID (not the localized name "Users") ---
+icacls "$configPath" /grant '*S-1-5-32-545:M'
+if ($LASTEXITCODE -ne 0) {
+    Write-Warning "icacls returned exit code $LASTEXITCODE — permission not changed."
+    return
+}
+Write-Host 'Done. Relaunch Open Dental as the standard user to confirm the window is gone.' -ForegroundColor Green