Add inventory audit mode with camera QR scanning

Lets an employee walk the premises, scan each object's QR to confirm
it's present and record where it was found (defaulting to the last
picked location), and track found/not-found progress for the walk.
Scanning a box's QR shows its contents read-only without affecting
the found/not-found counts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/routers/objects.py

@@ -4,7 +4,7 @@ from fastapi import APIRouter, HTTPException, status
 from sqlalchemy.exc import IntegrityError
 
 from app.core.dependencies import CurrentUser, DbSession, get_minio_client
-from app.schemas.object import ObjectCreate, ObjectRead, ObjectUpdate
+from app.schemas.object import ObjectCreate, ObjectRead, ObjectScan, ObjectUpdate
 from app.services import objects as objects_service
 
 router = APIRouter(prefix="/api/v1/objects", tags=["objects"])
@@ -53,6 +53,16 @@ async def update_object(
     return objects_service.build_object_read(obj)
 
 
+@router.post("/{object_id}/scan", response_model=ObjectRead)
+async def scan_object(db: DbSession, _: CurrentUser, object_id: uuid.UUID, data: ObjectScan) -> ObjectRead:
+    """Mark an object as found during an inventory audit walk, recording where it was seen."""
+    obj = await objects_service.get_object(db, object_id)
+    if obj is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Object not found")
+    obj = await objects_service.mark_object_found(db, obj, data.box_id)
+    return objects_service.build_object_read(obj)
+
+
 @router.delete("/{object_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_object(db: DbSession, _: CurrentUser, object_id: uuid.UUID) -> None:
     obj = await objects_service.get_object(db, object_id)