feat(api): dept/vendor asset lists, asset QR and label

[TomikeDS]

Closes #1595
Closes #1594
Closes #1593
Closes #1592

Summary

• Department users/assets and vendor assets endpoints used by the frontend are not implemented #1594: adds the three paginated read endpoints the frontend already calls: GET /departments/:id/assets (by departmentId), GET /departments/:id/users (non-sensitive columns only; no hash or token fields are selected) and GET /vendors/:id/assets (by supplierId). All sit behind the existing JwtAuthGuard, return the standard {items,total,page,limit,totalPages} shape, and 404 for an unknown department/vendor. Specs cover populated, empty and 404 cases.
• Add the QR code endpoint (GET /assets/:id/qr) and printable label support #1595: adds GET /assets/:id/qr (format=png|svg, size 64-1024) encoding ${FRONTEND_URL}/assets/:id, and GET /assets/:id/label, a Code 128 barcode PNG of the asset tag via bwip-js. Both are JWT-guarded, return the correct Content-Type, and 404 for an unknown asset. Uses the already-installed qrcode and bwip-js.
• Frontend calls POST /users/invite and PATCH /users/:id/active, which do not exist on the backend #1593 and Document upload size limit trusts a client-supplied fileSizeBytes field #1592 are not implemented in this PR; only 2 of the 4 assigned issues are addressed.

Note: the frontend getVendorAssets is typed as unknown[] but now receives the paginated object; it should read .items.

Linked issues

Closes #1595, #1594, #1593, #1592 (see top of description)

Checks

• Lint passes for every area touched
• Build passes
• Tests pass
• No secrets, keys, or .env values are committed

Not run: dependencies were not installed in this workflow, so lint, build and tests were not executed. The scan URL path (/assets/:id) assumes the frontend route; #1596 adds a dedicated scan endpoint that this could later point to.

[vercel]

@TomikeDS is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@TomikeDS Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits