Replace box picker with free-text location in audit scan

"Where found" during inventory audit is now a plain text field
(e.g. "каб. 305") stored on the object instead of assigning it to a
box, since audit walks often use room/office labels that don't map
to the box/shelf hierarchy used elsewhere. Box assignment via the
regular object form is unaffected.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/test_objects.py

@@ -47,26 +47,25 @@ async def test_duplicate_inventory_number_conflicts(client: AsyncClient, auth_he
     await client.delete(f"/api/v1/objects/{first.json()['id']}", headers=auth_headers)
 
 
-async def test_scan_marks_object_found_and_moves_it(client: AsyncClient, auth_headers: dict[str, str]) -> None:
+async def test_scan_marks_object_found_with_location(client: AsyncClient, auth_headers: dict[str, str]) -> None:
     inventory_number = f"TEST-{uuid.uuid4().hex[:8]}"
     create_res = await client.post(
         "/api/v1/objects", headers=auth_headers, json={"inventory_number": inventory_number, "name": "Scan test"}
     )
     object_id = create_res.json()["id"]
     assert create_res.json()["last_seen_at"] is None
-
-    box_res = await client.post("/api/v1/boxes", headers=auth_headers, json={"name": "Audit room"})
-    box_id = box_res.json()["id"]
+    assert create_res.json()["last_seen_location"] is None
 
     scan_res = await client.post(
-        f"/api/v1/objects/{object_id}/scan", headers=auth_headers, json={"box_id": box_id}
+        f"/api/v1/objects/{object_id}/scan", headers=auth_headers, json={"location": "каб. 305"}
     )
     assert scan_res.status_code == 200
-    assert scan_res.json()["box_id"] == box_id
+    assert scan_res.json()["last_seen_location"] == "каб. 305"
     assert scan_res.json()["last_seen_at"] is not None
+    # Scanning only records where it was found; it does not touch the box assignment.
+    assert scan_res.json()["box_id"] is None
 
     await client.delete(f"/api/v1/objects/{object_id}", headers=auth_headers)
-    await client.delete(f"/api/v1/boxes/{box_id}", headers=auth_headers)
 
 
 async def test_object_qrcode(client: AsyncClient, auth_headers: dict[str, str]) -> None: