GET /tools/{id}/qr — print-ready QR codes for label printers

Public REST API now exposes the same QR-generation surface the in-app UI uses. Returns a 600px PNG by default (or SVG with ?fmt=svg; ?size=N clamps 120-2000) encoding a deep-link to /scan/{scanToken}. Error correction Level H so the code stays scannable with up to ~30% of the surface obscured (real-world: dirt, scratches, partial damage). Designed for the loop "pull the tool roster, generate a label per row, batch-print to the Zebra / Brother / Dymo" — no more screen-scraping the in-app surface. Scope: tools:read. Cross-tenant safe (404 on tools the org doesn't own).