Add asset checkout, quantity/uniqueness, contacts, and QR labels

Checkout:
- assets.AssignUser + POST /app/assets/{id}/checkout assign/unassign an
  asset's user independent of the full edit form. New shared
  #checkoutModal, wired from a "Check Out..." context-menu action, backed
  by GET /app/assets/{id} and GET /app/users/options JSON endpoints.

Quantity / uniqueness:
- Item types gain an IsUnique flag (checked by default, matching prior
  behavior). Assets gain a Quantity column, fixed at 1 for unique types
  and adjustable via +/- steppers (POST /app/assets/{id}/quantity) for
  non-unique ones. Flipping a type back to unique clamps existing assets'
  quantity back to 1. CSV import/export gained a Quantity column.
  Migration 0003_quantity.sql.

Contacts:
- New models.RoleContact: an assignable person who cannot sign in
  (User.CanLogin). Migration 0004_contacts.sql rebuilds the users table
  (SQLite can't alter a CHECK constraint in place) to allow the role.
  Users form/list updated; contact creation auto-generates an unusable
  password since the login path is blocked by role regardless.

QR asset tags and printable labels:
- Each asset's QR code (via github.com/skip2/go-qrcode, pure Go) encodes
  an absolute /scan/<tag> URL; GET /scan/{tag} resolves it and redirects
  into /inventory?asset=<id>, which app.js picks up on load to
  auto-select that asset - works from a phone camera or a USB
  scanner-as-keyboard-wedge pointed at the address bar.
- GET /labels renders a print-ready sheet (right-click an asset for one
  label, a folder for every asset in it) with a template switcher between
  Avery 5160 (verified dimensions) and 61526 asset tag labels (best-effort
  layout, flagged as such on the page).

Also refreshed README to reflect the right-click-first tree UX and all of
the above.

internal/models/models.go

@@ -8,6 +8,11 @@ type Role string
 const (
 	RoleAdmin Role = "admin"
 	RoleUser  Role = "user"
+	// RoleContact is an assignable person (end user) with no ability to
+	// sign in - useful for tracking who a checked-out asset belongs to
+	// without needing to create a login account for everyone in a
+	// building.
+	RoleContact Role = "contact"
 )
 
 type User struct {
@@ -22,6 +27,10 @@ type User struct {
 
 func (u User) IsAdmin() bool { return u.Role == RoleAdmin }
 
+// CanLogin reports whether this account is allowed to sign in at all;
+// contacts exist only to be assigned assets.
+func (u User) CanLogin() bool { return u.Role == RoleAdmin || u.Role == RoleUser }
+
 type Folder struct {
 	ID          int64
 	Name        string
@@ -96,6 +105,12 @@ type ItemType struct {
 	CreatedAt   time.Time
 	UpdatedAt   time.Time
 
+	// IsUnique means each asset of this type is its own distinct item
+	// (a laptop with its own serial number, tracked as one row per unit).
+	// When false, assets of this type are bulk/consumable line items
+	// (e.g. "USB-A Cable") tracked by Quantity instead of one row each.
+	IsUnique bool
+
 	Fields []CustomFieldDef
 }
 
@@ -129,12 +144,16 @@ type Asset struct {
 	StatusID       int64
 	AssignedUserID *int64
 	Notes          string
-	CreatedAt      time.Time
-	UpdatedAt      time.Time
+	// Quantity is meaningful only when the asset's item type is not
+	// IsUnique; unique-type assets are always kept at 1.
+	Quantity  int
+	CreatedAt time.Time
+	UpdatedAt time.Time
 
 	// Populated by joined list/detail queries.
 	ItemTypeName     string
 	ItemTypeIcon     string
+	ItemTypeIsUnique bool
 	StatusName       string
 	StatusColor      string
 	AssignedUsername string