Add asset checkout, quantity/uniqueness, contacts, and QR labels

Checkout:
- assets.AssignUser + POST /app/assets/{id}/checkout assign/unassign an
  asset's user independent of the full edit form. New shared
  #checkoutModal, wired from a "Check Out..." context-menu action, backed
  by GET /app/assets/{id} and GET /app/users/options JSON endpoints.

Quantity / uniqueness:
- Item types gain an IsUnique flag (checked by default, matching prior
  behavior). Assets gain a Quantity column, fixed at 1 for unique types
  and adjustable via +/- steppers (POST /app/assets/{id}/quantity) for
  non-unique ones. Flipping a type back to unique clamps existing assets'
  quantity back to 1. CSV import/export gained a Quantity column.
  Migration 0003_quantity.sql.

Contacts:
- New models.RoleContact: an assignable person who cannot sign in
  (User.CanLogin). Migration 0004_contacts.sql rebuilds the users table
  (SQLite can't alter a CHECK constraint in place) to allow the role.
  Users form/list updated; contact creation auto-generates an unusable
  password since the login path is blocked by role regardless.

QR asset tags and printable labels:
- Each asset's QR code (via github.com/skip2/go-qrcode, pure Go) encodes
  an absolute /scan/<tag> URL; GET /scan/{tag} resolves it and redirects
  into /inventory?asset=<id>, which app.js picks up on load to
  auto-select that asset - works from a phone camera or a USB
  scanner-as-keyboard-wedge pointed at the address bar.
- GET /labels renders a print-ready sheet (right-click an asset for one
  label, a folder for every asset in it) with a template switcher between
  Avery 5160 (verified dimensions) and 61526 asset tag labels (best-effort
  layout, flagged as such on the page).

Also refreshed README to reflect the right-click-first tree UX and all of
the above.

internal/web/router.go

@@ -49,16 +49,26 @@ func (a *App) Router() http.Handler {
 	mux.HandleFunc("DELETE /app/folders/{id}", a.requireAdmin(a.handleFolderDelete))
 
 	// Asset mutations (JSON in/out)
+	mux.HandleFunc("GET /app/assets/{id}", a.requireAdmin(a.handleAssetGet))
 	mux.HandleFunc("POST /app/assets", a.requireAdmin(a.handleAssetCreate))
 	mux.HandleFunc("PATCH /app/assets/{id}", a.requireAdmin(a.handleAssetUpdate))
 	mux.HandleFunc("DELETE /app/assets/{id}", a.requireAdmin(a.handleAssetDelete))
 	mux.HandleFunc("POST /app/assets/{id}/duplicate", a.requireAdmin(a.handleAssetDuplicate))
 	mux.HandleFunc("POST /app/assets/{id}/move", a.requireAdmin(a.handleAssetMove))
+	mux.HandleFunc("POST /app/assets/{id}/checkout", a.requireAdmin(a.handleAssetCheckout))
+	mux.HandleFunc("POST /app/assets/{id}/quantity", a.requireAdmin(a.handleAssetQuantity))
+
+	mux.HandleFunc("GET /app/users/options", a.requireAdmin(a.handleUserOptions))
 
 	// CSV import/export
 	mux.HandleFunc("GET /export/assets.csv", a.requireLogin(a.handleExportCSV))
 	mux.HandleFunc("POST /import/assets.csv", a.requireAdmin(a.handleImportCSV))
 
+	// QR asset tags: scan a printed label to jump to that asset, or print
+	// a sheet of labels for a folder/asset.
+	mux.HandleFunc("GET /scan/{tag}", a.requireLogin(a.handleScan))
+	mux.HandleFunc("GET /labels", a.requireLogin(a.handleLabelsPage))
+
 	// Settings (admin, traditional pages) - Item Types, Users, and general
 	// settings all live under one unified /settings section with shared
 	// sub-navigation, rather than as separate top-level nav items.