Admin-scoped user accounts, secure qr code storage, PHP 8.4 upgrade

Admin-scoped users (answers: who can create a 'user' account, only super or
also an admin within their own scope?):
- New owner_admin_id column on users (migration 004). NULL means created by
  super (company-wide, previous behavior); otherwise scoped to that admin's
  own codes.
- Users::addUser/editUser/deleteUser now allow an 'admin' session, but force
  type='user' and owner_admin_id to their own id regardless of submitted
  input. user.php/users.php open up to admins with a restricted UI (no type
  picker, listing limited to their own created users).
- New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility()
  helpers in includes/security.php, replacing the ad-hoc type==='admin' checks
  in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php.
  A 'user' account created by an admin is now scoped to that admin's codes
  instead of seeing everything company-wide.

Qr code storage hardening: images were served as plain static files under the
document root with no auth check at all. Storage now lives outside the web
root; qrcode_image.php and qrcode_zip_download.php gate access with the same
permission model as the list pages, and the bulk zip download is bound to the
session that generated it.

PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app,
so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag
itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an
unpinned clone of master, which has since moved past the tag. Fixed along the
way, surfaced by testing on 8.4:
- The hardcoded Imagick build (an old pinned master commit, workaround for
  3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is
  now a normal stable release, so the workaround is gone.
- config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new
  deprecation notices got dumped straight into the response before
  session_start() could run, breaking login outright. Also an info-disclosure
  risk on its own. Now logged instead of displayed.
- MysqliDb::insertMulti() had an implicit nullable parameter, now explicit.
- includes/auth_validate.php redirected unauthenticated requests but never
  called exit(), so the rest of the script kept running.
- Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode)
  and the imagick extension entirely.

Also removes the unused sample qr code images that shipped in the original
repo; storage now lives outside the document root so they were never going
to be served again.

src/qrcode_image.php

@@ -0,0 +1,63 @@
+<?php
+/**
+ * Authenticated view/download endpoint for a generated qr code image.
+ * Replaces the previous direct static URL under saved_qrcode/, which any visitor
+ * could reach without logging in. Enforces the same visibility rules as the list
+ * pages (dynamic_qrcodes.php / static_qrcodes.php).
+ */
+require_once 'includes/bootstrap.php';
+require_once BASE_PATH . '/includes/auth_validate.php';
+
+$type = $_GET['type'] ?? '';
+$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
+
+if (!in_array($type, ['static', 'dynamic'], true) || !$id) {
+    http_response_code(404);
+    exit('Not found');
+}
+
+if ($_SESSION['type'] === 'user') {
+    $view_flag = $type === 'dynamic' ? 'can_view_dynamic' : 'can_view_static';
+    if (empty($_SESSION[$view_flag] ?? null)) {
+        http_response_code(403);
+        exit('Forbidden');
+    }
+}
+
+$db = getDbInstance();
+$db->where('id', $id);
+qr_apply_owner_scope($db);
+$row = $db->getOne("{$type}_qrcodes");
+
+if ($row === null) {
+    http_response_code(404);
+    exit('Not found');
+}
+
+$path = SAVED_QRCODE_DIRECTORY . $row['qrcode'];
+
+if (!is_file($path)) {
+    http_response_code(404);
+    exit('Not found');
+}
+
+$mime_types = [
+    'png' => 'image/png',
+    'jpg' => 'image/jpeg',
+    'jpeg' => 'image/jpeg',
+    'gif' => 'image/gif',
+    'svg' => 'image/svg+xml',
+    'eps' => 'application/postscript',
+];
+$extension = strtolower(pathinfo($path, PATHINFO_EXTENSION));
+$mime = $mime_types[$extension] ?? 'application/octet-stream';
+
+$is_download = isset($_GET['download']) && $_GET['download'] === '1';
+
+header('Content-Type: ' . $mime);
+header('Content-Length: ' . filesize($path));
+header('Cache-Control: private, max-age=0, no-cache');
+header('Content-Disposition: ' . ($is_download ? 'attachment' : 'inline') . '; filename="' . basename($path) . '"');
+
+readfile($path);
+exit;