Admin-scoped user accounts, secure qr code storage, PHP 8.4 upgrade

Admin-scoped users (answers: who can create a 'user' account, only super or
also an admin within their own scope?):
- New owner_admin_id column on users (migration 004). NULL means created by
  super (company-wide, previous behavior); otherwise scoped to that admin's
  own codes.
- Users::addUser/editUser/deleteUser now allow an 'admin' session, but force
  type='user' and owner_admin_id to their own id regardless of submitted
  input. user.php/users.php open up to admins with a restricted UI (no type
  picker, listing limited to their own created users).
- New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility()
  helpers in includes/security.php, replacing the ad-hoc type==='admin' checks
  in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php.
  A 'user' account created by an admin is now scoped to that admin's codes
  instead of seeing everything company-wide.

Qr code storage hardening: images were served as plain static files under the
document root with no auth check at all. Storage now lives outside the web
root; qrcode_image.php and qrcode_zip_download.php gate access with the same
permission model as the list pages, and the bulk zip download is bound to the
session that generated it.

PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app,
so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag
itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an
unpinned clone of master, which has since moved past the tag. Fixed along the
way, surfaced by testing on 8.4:
- The hardcoded Imagick build (an old pinned master commit, workaround for
  3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is
  now a normal stable release, so the workaround is gone.
- config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new
  deprecation notices got dumped straight into the response before
  session_start() could run, breaking login outright. Also an info-disclosure
  risk on its own. Now logged instead of displayed.
- MysqliDb::insertMulti() had an implicit nullable parameter, now explicit.
- includes/auth_validate.php redirected unauthenticated requests but never
  called exit(), so the rest of the script kept running.
- Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode)
  and the imagick extension entirely.

Also removes the unused sample qr code images that shipped in the original
repo; storage now lives outside the document root so they were never going
to be served again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/includes/auth_validate.php

@@ -3,8 +3,9 @@
 //If User is logged in the session['user_logged_in'] will be set to true
 
 //if user is Not Logged in, redirect to login.php page.
-if (!isset($_SESSION['user_logged_in'])) {
+if (empty($_SESSION['user_logged_in'])) {
 	header('Location:login.php');
+	exit;
 }
 
  ?>

src/includes/security.php

@@ -143,6 +143,49 @@ function qr_is_login_locked_out($username) {
     return $count !== null && $count >= LOGIN_MAX_ATTEMPTS;
 }
 
+/**
+ * Compute the owner-scope for a freshly authenticated user row (see qr_scope_owner_id()
+ * below for the meaning of the returned value). Call once at login and store the result
+ * in $_SESSION['scope_owner_id'].
+ */
+function qr_compute_scope_owner_id($user_row) {
+    if ($user_row['type'] === 'admin') {
+        return (int) $user_row['id'];
+    }
+
+    if ($user_row['type'] === 'user' && !empty($user_row['owner_admin_id'])) {
+        return (int) $user_row['owner_admin_id'];
+    }
+
+    return null;
+}
+
+/**
+ * Owner-scope for the qr code lists/reports, set at login time in $_SESSION['scope_owner_id']:
+ * - null: full visibility (super, or a company-wide 'user' account created by super)
+ * - int:  restricted to codes owned by this admin id (an admin's own account, or a
+ *         'user' account created by that admin)
+ */
+function qr_scope_owner_id() {
+    return $_SESSION['scope_owner_id'] ?? null;
+}
+
+function qr_has_full_visibility() {
+    return qr_scope_owner_id() === null;
+}
+
+/**
+ * Apply the current session's owner scope to a MysqliDb query builder in place.
+ * No-op when the session has full visibility.
+ */
+function qr_apply_owner_scope($db) {
+    $scope_owner_id = qr_scope_owner_id();
+    if ($scope_owner_id !== null) {
+        $db->where('id_owner', $scope_owner_id);
+        $db->orWhere('id_owner', NULL, 'IS');
+    }
+}
+
 /**
  * Audit log
  */

src/includes/sidebar.php

@@ -87,7 +87,7 @@
                 </ul>
             </li>
             <?php endif; ?>
-          <?php if ($_SESSION['type'] === 'super'): ?>
+          <?php if (in_array($_SESSION['type'], ['super', 'admin'], true)): ?>
           <li class="nav-item">
             <a href="./users.php" <?php echo ((substr(CURRENT_PAGE, 0, 15) == 'users.php') || (substr(CURRENT_PAGE, 0, 14) == 'user.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
                 <i class="fas fa-users nav-icon"></i>