Jul 9 - Update to allow customer to manage their facilities' QR codes

CLAUDE.md

@@ -407,6 +407,8 @@ Management (`/scheduled-inspections/new|edit|delete`) is `@project_manager_requi
 | Notification Matrix | ✅ only | ❌ | ❌ | ❌ | ❌ |
 | Customers | ✅ | ✅ | ❌ | ❌ | ❌ |
 | Facilities | ✅ | ✅ | ✅ | read | scoped |
+| Facility QR (view/print) | ✅ | ✅ | ✅ | ✅ | scoped |
+| Facility QR (regenerate) | ✅ | ✅ | ❌ | ❌ | scoped |
 | Contracts | ✅ | ✅ | ✅ | read | scoped |
 | Templates | ✅ | ✅ | ❌ | ❌ | ❌ |
 | Inspections (execute) | ✅ | ✅ | ✅ | ✅ | read |
@@ -438,7 +440,7 @@ Management (`/scheduled-inspections/new|edit|delete`) is `@project_manager_requi
 |---|---|---|
 | `auth` | `/auth` | `/login`, `/logout`, `/profile`, `/users/*`, `/notification-matrix` |
 | `dashboard` | `/` | `GET /`, `/facility-trend` (AJAX) |
-| `facilities` | `/facilities` | CRUD + area management + QR code: `/<id>/qr` printable page, `/<id>/qr.png` image, `POST /<id>/qr/regenerate` (admin/director — invalidates old printed code), `/qr/print-all[?contract_id=]` bulk sheet. All QR routes are staff-only (customers 403); inspectors scoped to contracted facilities. |
+| `facilities` | `/facilities` | CRUD + area management + QR code: `/<id>/qr` printable page, `/<id>/qr.png` image, `POST /<id>/qr/regenerate` (invalidates old printed code), `/qr/print-all[?contract_id=]` bulk sheet. **Customers may use all QR actions (including regenerate) for their own assigned facilities**; inspectors/PM/admin/director for any. Scope enforced by `_facility_for_qr_or_403()` (customers) / `get_customer_scope` (print-all). Regenerate is limited to admin/director + scoped customer (PM/inspector excluded). |
 | `public` | `/f` | **No login.** `GET /<token>` occupant facility summary; `POST /<token>/report` occupant issue report (rate-limited `5/hour`, honeypot). Resolves ACTIVE facility by `public_token` or 404. |
 | `projects` | `/projects` | CRUD + customer assignment management + notification-recipient add/remove (`/<id>/notify-recipients/add`, `/notify-recipients/<rid>/remove` — admin only) |
 | `customers` | `/customers` | list, invite, set-password, manage, import CSV |