Admin-scoped user accounts, secure qr code storage, PHP 8.4 upgrade

Admin-scoped users (answers: who can create a 'user' account, only super or
also an admin within their own scope?):
- New owner_admin_id column on users (migration 004). NULL means created by
  super (company-wide, previous behavior); otherwise scoped to that admin's
  own codes.
- Users::addUser/editUser/deleteUser now allow an 'admin' session, but force
  type='user' and owner_admin_id to their own id regardless of submitted
  input. user.php/users.php open up to admins with a restricted UI (no type
  picker, listing limited to their own created users).
- New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility()
  helpers in includes/security.php, replacing the ad-hoc type==='admin' checks
  in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php.
  A 'user' account created by an admin is now scoped to that admin's codes
  instead of seeing everything company-wide.

Qr code storage hardening: images were served as plain static files under the
document root with no auth check at all. Storage now lives outside the web
root; qrcode_image.php and qrcode_zip_download.php gate access with the same
permission model as the list pages, and the bulk zip download is bound to the
session that generated it.

PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app,
so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag
itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an
unpinned clone of master, which has since moved past the tag. Fixed along the
way, surfaced by testing on 8.4:
- The hardcoded Imagick build (an old pinned master commit, workaround for
  3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is
  now a normal stable release, so the workaround is gone.
- config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new
  deprecation notices got dumped straight into the response before
  session_start() could run, breaking login outright. Also an info-disclosure
  risk on its own. Now logged instead of displayed.
- MysqliDb::insertMulti() had an implicit nullable parameter, now explicit.
- includes/auth_validate.php redirected unauthenticated requests but never
  called exit(), so the rest of the script kept running.
- Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode)
  and the imagick extension entirely.

Also removes the unused sample qr code images that shipped in the original
repo; storage now lives outside the document root so they were never going
to be served again.

src/forms/form_users.php

@@ -6,12 +6,12 @@
                 <div class="input-group-prepend">
                     <span class="input-group-text"><i class="fa fa-user"></i></span>
                 </div>
-                
+
                 <input type="text" name="username" placeholder="Username" class="form-control" required="required" value="<?php echo ($edit) ? $user['username'] : ''; ?>" autocomplete="off">
             </div>
         </div>
     </div>
-    
+
     <div class="col-sm-4">
         <div class="form-group">
             <label for="password">Password *</label>
@@ -19,21 +19,22 @@
                 <div class="input-group-prepend">
                     <span class="input-group-text"><i class="fa fa-lock"></i></span>
                 </div>
-                
+
                 <input type="password" name="password" placeholder="<?php echo ($edit) ? 'Leave blank to keep current password' : 'Password'; ?>" class="form-control" <?php echo ($edit) ? '' : 'required="required"'; ?> minlength="10" autocomplete="off">
             </div>
         </div>
     </div>
 
+    <?php if ($_SESSION['type'] === 'super'): ?>
     <div class="col-sm-4">
         <label for="user-type">User type *</label>
-        
+
         <div class="form-group">
             <div class="radio">
                 <label class="radio">
                 <input type="radio" name="type" value="super" required="required" <?php echo ($edit && $user['type'] =='super') ? "checked": "" ; ?>/> Super admin</label>
             </div>
-            
+
             <div class="radio">
                 <label class="radio">
                 <input type="radio" name="type" value="admin" required="required" <?php echo ($edit && $user['type'] =='admin') ? "checked": "" ; ?>/> Admin</label>
@@ -47,17 +48,17 @@
     </div>
 
     <div class="col-sm-12 mt-2" id="user-view-toggles">
-        <label>Zichtbaarheid voor 'User'-rol</label>
+        <label>Visibility for the 'User' role</label>
         <div class="form-group">
             <div class="icheck-primary d-inline-block mr-4">
                 <input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
-                <label for="can_view_static">Mag statische QR-codes bekijken</label>
+                <label for="can_view_static">Can view static qr codes</label>
             </div>
             <div class="icheck-primary d-inline-block">
                 <input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
-                <label for="can_view_dynamic">Mag dynamische QR-codes bekijken</label>
+                <label for="can_view_dynamic">Can view dynamic qr codes</label>
             </div>
-            <small class="form-text text-muted">Alleen van toepassing op het type 'User'. Reports/statistieken zijn voor 'User' altijd zichtbaar.</small>
+            <small class="form-text text-muted">Only applies to the 'User' type. Reports/statistics are always visible for 'User'.</small>
         </div>
     </div>
 
@@ -78,9 +79,28 @@
             updateToggleVisibility();
         })();
     </script>
+    <?php else: ?>
+    <!-- An 'admin' can only create/manage their own read-only 'user' accounts. -->
+    <input type="hidden" name="type" value="user">
+
+    <div class="col-sm-12 mt-2">
+        <label>Visibility for this user</label>
+        <div class="form-group">
+            <div class="icheck-primary d-inline-block mr-4">
+                <input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
+                <label for="can_view_static">Can view static qr codes</label>
+            </div>
+            <div class="icheck-primary d-inline-block">
+                <input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
+                <label for="can_view_dynamic">Can view dynamic qr codes</label>
+            </div>
+            <small class="form-text text-muted">Reports/statistics are always visible for this account.</small>
+        </div>
+    </div>
+    <?php endif; ?>
 
     <?php if($edit) { ?>
         <input type="hidden" name="id" value="<?php echo $user['id'];?>"/>
         <input type="hidden" name="edit" value="true"/>
     <?php } ?>
-</fieldset>
+</fieldset>