Admin-scoped user accounts, secure qr code storage, PHP 8.4 upgrade

Admin-scoped users (answers: who can create a 'user' account, only super or
also an admin within their own scope?):
- New owner_admin_id column on users (migration 004). NULL means created by
  super (company-wide, previous behavior); otherwise scoped to that admin's
  own codes.
- Users::addUser/editUser/deleteUser now allow an 'admin' session, but force
  type='user' and owner_admin_id to their own id regardless of submitted
  input. user.php/users.php open up to admins with a restricted UI (no type
  picker, listing limited to their own created users).
- New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility()
  helpers in includes/security.php, replacing the ad-hoc type==='admin' checks
  in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php.
  A 'user' account created by an admin is now scoped to that admin's codes
  instead of seeing everything company-wide.

Qr code storage hardening: images were served as plain static files under the
document root with no auth check at all. Storage now lives outside the web
root; qrcode_image.php and qrcode_zip_download.php gate access with the same
permission model as the list pages, and the bulk zip download is bound to the
session that generated it.

PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app,
so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag
itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an
unpinned clone of master, which has since moved past the tag. Fixed along the
way, surfaced by testing on 8.4:
- The hardcoded Imagick build (an old pinned master commit, workaround for
  3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is
  now a normal stable release, so the workaround is gone.
- config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new
  deprecation notices got dumped straight into the response before
  session_start() could run, breaking login outright. Also an info-disclosure
  risk on its own. Now logged instead of displayed.
- MysqliDb::insertMulti() had an implicit nullable parameter, now explicit.
- includes/auth_validate.php redirected unauthenticated requests but never
  called exit(), so the rest of the script kept running.
- Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode)
  and the imagick extension entirely.

Also removes the unused sample qr code images that shipped in the original
repo; storage now lives outside the document root so they were never going
to be served again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

db/init.sql

@@ -18,6 +18,7 @@ CREATE TABLE IF NOT EXISTS `users` (
   `password_changed_at` datetime DEFAULT NULL,
   `can_view_static` tinyint(1) NOT NULL DEFAULT 0,
   `can_view_dynamic` tinyint(1) NOT NULL DEFAULT 0,
+  `owner_admin_id` int(25) DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `username` (`username`)
 ) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=0 ;
@@ -60,7 +61,7 @@ CREATE TABLE IF NOT EXISTS `static_qrcodes` (
   PRIMARY KEY (`id`)
 ) ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=0 ;
 
--- Security hardening (Fase 1): rate limiting op login pogingen
+-- Security hardening (Fase 1): rate limiting on login attempts
 CREATE TABLE IF NOT EXISTS `login_attempts` (
   `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
   `username` varchar(50) NOT NULL,
@@ -72,7 +73,7 @@ CREATE TABLE IF NOT EXISTS `login_attempts` (
   KEY `ip_attempted_at` (`ip_address`, `attempted_at`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 
--- Security hardening (Fase 1): audit log van gevoelige acties
+-- Security hardening (Fase 1): audit log of sensitive actions
 CREATE TABLE IF NOT EXISTS `audit_log` (
   `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
   `user_id` int(25) DEFAULT NULL,

db/migrations/002_security_hardening.sql

@@ -1,7 +1,7 @@
--- Fase 1 security hardening migratie.
--- Voer uit tegen een bestaande database (gebruikt de originele
--- giandonatoinverso/php-dynamic-qr-code-db image of een oudere init.sql).
--- Kolommen/tabellen worden alleen toegevoegd als ze nog niet bestaan.
+-- Fase 1 security hardening migration.
+-- Run against an existing database (using the original
+-- giandonatoinverso/php-dynamic-qr-code-db image or an older init.sql).
+-- Columns/tables are only added if they don't already exist.
 
 SET @db := DATABASE();
 
@@ -23,8 +23,8 @@ SET @sql := IF(@col_exists = 0,
   'SELECT 1');
 PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 
--- Bestaand superadmin account met het fabriekswachtwoord (superadmin/superadmin)
--- moet bij eerstvolgende login het wachtwoord wijzigen.
+-- An existing superadmin account with the factory password (superadmin/superadmin)
+-- must change its password on next login.
 UPDATE `users`
 SET `must_change_password` = 1
 WHERE `username` = 'superadmin'

db/migrations/003_user_role.sql

@@ -1,5 +1,5 @@
--- Fase 2: read-only 'user' rol met twee zichtbaarheids-toggles.
--- type='user' vereist geen schemawijziging (varchar(10), geen enum-constraint).
+-- Fase 2: read-only 'user' role with two visibility toggles.
+-- type='user' requires no schema change (varchar(10), no enum constraint).
 
 SET @db := DATABASE();
 

db/migrations/004_admin_scoped_users.sql

@@ -0,0 +1,14 @@
+-- Option 2: an admin may create their own 'user' accounts within their own scope.
+-- owner_admin_id = NULL means: created by super, company-wide (previous behavior).
+-- owner_admin_id = <id> means: created by that admin, sees only that admin's own codes.
+
+SET @db := DATABASE();
+
+SET @col_exists := (
+  SELECT COUNT(*) FROM information_schema.COLUMNS
+  WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'owner_admin_id'
+);
+SET @sql := IF(@col_exists = 0,
+  'ALTER TABLE `users` ADD COLUMN `owner_admin_id` INT(25) DEFAULT NULL',
+  'SELECT 1');
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;