Add inventory audit mode with camera QR scanning

Lets an employee walk the premises, scan each object's QR to confirm
it's present and record where it was found (defaulting to the last
picked location), and track found/not-found progress for the walk.
Scanning a box's QR shows its contents read-only without affecting
the found/not-found counts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/test_objects.py

@@ -47,6 +47,28 @@ async def test_duplicate_inventory_number_conflicts(client: AsyncClient, auth_he
     await client.delete(f"/api/v1/objects/{first.json()['id']}", headers=auth_headers)
 
 
+async def test_scan_marks_object_found_and_moves_it(client: AsyncClient, auth_headers: dict[str, str]) -> None:
+    inventory_number = f"TEST-{uuid.uuid4().hex[:8]}"
+    create_res = await client.post(
+        "/api/v1/objects", headers=auth_headers, json={"inventory_number": inventory_number, "name": "Scan test"}
+    )
+    object_id = create_res.json()["id"]
+    assert create_res.json()["last_seen_at"] is None
+
+    box_res = await client.post("/api/v1/boxes", headers=auth_headers, json={"name": "Audit room"})
+    box_id = box_res.json()["id"]
+
+    scan_res = await client.post(
+        f"/api/v1/objects/{object_id}/scan", headers=auth_headers, json={"box_id": box_id}
+    )
+    assert scan_res.status_code == 200
+    assert scan_res.json()["box_id"] == box_id
+    assert scan_res.json()["last_seen_at"] is not None
+
+    await client.delete(f"/api/v1/objects/{object_id}", headers=auth_headers)
+    await client.delete(f"/api/v1/boxes/{box_id}", headers=auth_headers)
+
+
 async def test_object_qrcode(client: AsyncClient, auth_headers: dict[str, str]) -> None:
     inventory_number = f"TEST-{uuid.uuid4().hex[:8]}"
     create_res = await client.post(