Add asset checkout, quantity/uniqueness, contacts, and QR labels

Checkout:
- assets.AssignUser + POST /app/assets/{id}/checkout assign/unassign an
  asset's user independent of the full edit form. New shared
  #checkoutModal, wired from a "Check Out..." context-menu action, backed
  by GET /app/assets/{id} and GET /app/users/options JSON endpoints.

Quantity / uniqueness:
- Item types gain an IsUnique flag (checked by default, matching prior
  behavior). Assets gain a Quantity column, fixed at 1 for unique types
  and adjustable via +/- steppers (POST /app/assets/{id}/quantity) for
  non-unique ones. Flipping a type back to unique clamps existing assets'
  quantity back to 1. CSV import/export gained a Quantity column.
  Migration 0003_quantity.sql.

Contacts:
- New models.RoleContact: an assignable person who cannot sign in
  (User.CanLogin). Migration 0004_contacts.sql rebuilds the users table
  (SQLite can't alter a CHECK constraint in place) to allow the role.
  Users form/list updated; contact creation auto-generates an unusable
  password since the login path is blocked by role regardless.

QR asset tags and printable labels:
- Each asset's QR code (via github.com/skip2/go-qrcode, pure Go) encodes
  an absolute /scan/<tag> URL; GET /scan/{tag} resolves it and redirects
  into /inventory?asset=<id>, which app.js picks up on load to
  auto-select that asset - works from a phone camera or a USB
  scanner-as-keyboard-wedge pointed at the address bar.
- GET /labels renders a print-ready sheet (right-click an asset for one
  label, a folder for every asset in it) with a template switcher between
  Avery 5160 (verified dimensions) and 61526 asset tag labels (best-effort
  layout, flagged as such on the page).

Also refreshed README to reflect the right-click-first tree UX and all of
the above.

internal/web/handlers_assets.go

@@ -15,6 +15,7 @@ type assetRequest struct {
 	StatusID       int64             `json:"status_id"`
 	AssignedUserID *int64            `json:"assigned_user_id"`
 	Notes          string            `json:"notes"`
+	Quantity       int               `json:"quantity"`
 	Fields         map[string]string `json:"fields"`
 }
 
@@ -38,7 +39,7 @@ func (a *App) handleAssetCreate(w http.ResponseWriter, r *http.Request) {
 	}
 	asset := &models.Asset{
 		AssetTag: req.AssetTag, Name: req.Name, ItemTypeID: req.ItemTypeID, FolderID: req.FolderID,
-		StatusID: req.StatusID, AssignedUserID: req.AssignedUserID, Notes: req.Notes,
+		StatusID: req.StatusID, AssignedUserID: req.AssignedUserID, Notes: req.Notes, Quantity: req.Quantity,
 	}
 	if err := a.Assets.Create(r.Context(), asset, req.fieldValues()); err != nil {
 		jsonErr(w, http.StatusBadRequest, err)
@@ -65,7 +66,7 @@ func (a *App) handleAssetUpdate(w http.ResponseWriter, r *http.Request) {
 	}
 	asset := &models.Asset{
 		ID: id, AssetTag: req.AssetTag, Name: req.Name, ItemTypeID: existing.ItemTypeID, FolderID: req.FolderID,
-		StatusID: req.StatusID, AssignedUserID: req.AssignedUserID, Notes: req.Notes,
+		StatusID: req.StatusID, AssignedUserID: req.AssignedUserID, Notes: req.Notes, Quantity: req.Quantity,
 	}
 	if err := a.Assets.Update(r.Context(), asset, req.fieldValues()); err != nil {
 		jsonErr(w, http.StatusBadRequest, err)
@@ -127,3 +128,69 @@ func (a *App) handleAssetMove(w http.ResponseWriter, r *http.Request) {
 	}
 	jsonOK(w, map[string]any{"id": id, "folder_id": req.FolderID})
 }
+
+// handleAssetGet returns a single asset as JSON, for lightweight lookups
+// (e.g. the checkout modal) that don't need the full HTML detail panel.
+func (a *App) handleAssetGet(w http.ResponseWriter, r *http.Request) {
+	id, err := pathID(r, "id")
+	if err != nil {
+		jsonErr(w, http.StatusBadRequest, err)
+		return
+	}
+	asset, err := a.Assets.Get(r.Context(), id)
+	if err != nil {
+		jsonErr(w, http.StatusNotFound, err)
+		return
+	}
+	jsonOK(w, asset)
+}
+
+type assetCheckoutRequest struct {
+	AssignedUserID *int64 `json:"assigned_user_id"`
+}
+
+// handleAssetCheckout assigns (checks out) or unassigns (checks in) an
+// asset's user without touching any other field.
+func (a *App) handleAssetCheckout(w http.ResponseWriter, r *http.Request) {
+	id, err := pathID(r, "id")
+	if err != nil {
+		jsonErr(w, http.StatusBadRequest, err)
+		return
+	}
+	var req assetCheckoutRequest
+	if err := readJSON(r, &req); err != nil {
+		jsonErr(w, http.StatusBadRequest, err)
+		return
+	}
+	if err := a.Assets.AssignUser(r.Context(), id, req.AssignedUserID); err != nil {
+		jsonErr(w, http.StatusInternalServerError, err)
+		return
+	}
+	jsonOK(w, map[string]any{"id": id, "assigned_user_id": req.AssignedUserID})
+}
+
+type assetQuantityRequest struct {
+	Delta int `json:"delta"`
+}
+
+// handleAssetQuantity increments or decrements a non-unique asset's
+// quantity in place, for the +/- steppers on the asset panel and folder
+// tables.
+func (a *App) handleAssetQuantity(w http.ResponseWriter, r *http.Request) {
+	id, err := pathID(r, "id")
+	if err != nil {
+		jsonErr(w, http.StatusBadRequest, err)
+		return
+	}
+	var req assetQuantityRequest
+	if err := readJSON(r, &req); err != nil {
+		jsonErr(w, http.StatusBadRequest, err)
+		return
+	}
+	asset, err := a.Assets.AdjustQuantity(r.Context(), id, req.Delta)
+	if err != nil {
+		jsonErr(w, http.StatusBadRequest, err)
+		return
+	}
+	jsonOK(w, map[string]any{"id": id, "quantity": asset.Quantity})
+}