Fase 2: read-only user role with per-category view toggles

Adds a third account type 'user' alongside super/admin: no create/edit/delete
rights on qr codes, view access to dynamic/static lists gated per-account by
two admin-controlled toggles (can_view_static, can_view_dynamic), and always
full visibility into the dashboard/reports regardless of those toggles.

- New columns can_view_static/can_view_dynamic on users (migrations/003)
- Users class + form_users.php: 'user' type option with the two toggles
- Access control: dynamic_qrcode.php/static_qrcode.php/bulk_action.php reject
  all mutations for type=user; dynamic_qrcodes.php/static_qrcodes.php enforce
  the view toggle and show all codes (no owner scoping, since 'user' owns none)
- Sidebar and list tables hide add/edit/delete/bulk UI for the read-only role
- index.php dashboard stats are unscoped for both 'super' and 'user'

src/lib/Users/Users.php

@@ -3,7 +3,7 @@ require_once 'config/config.php';
 
 class Users
 {
-    const ALLOWED_TYPES = ['super', 'admin'];
+    const ALLOWED_TYPES = ['super', 'admin', 'user'];
 
     /**
      *
@@ -87,6 +87,8 @@ class Users
         $data_to_db["username"] = $input_data["username"];
         $data_to_db['password'] = password_hash($input_data['password'], PASSWORD_DEFAULT);
         $data_to_db["type"] = $input_data["type"];
+        $data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0;
+        $data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0;
 
         $db->where('username', $data_to_db['username']);
         $db->get('users');
@@ -133,6 +135,8 @@ class Users
 
         $data_to_db["username"] = $input_data["username"];
         $data_to_db["type"] = $input_data["type"];
+        $data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0;
+        $data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0;
 
         // Alleen wachtwoord overschrijven als er een nieuwe waarde is opgegeven.
         if (!empty($input_data['password'])) {