QR code for the share link

Bearer-authed twin of the public /api/files/{uuid}/qr-code endpoint, returning the same PNG. There is NO ownership check: any valid credential with files:read can fetch the QR of any live file id, because the image only encodes the public share URL (durable short-id form on the owner's custom domain when verified, never the slug, with ?via=qr so scans show up in the readership source breakdown). Unknown, expired, trashed or burned ids answer 404. Cached for a day (Cache-Control: public, max-age=86400). When handing a QR URL to a third party (an email, a Zap output, a downstream app), use the public path - it needs no Authorization header. The response is binary - hand the URL to the user rather than returning the bytes to a model.