feat: roles admin, custom fields, developers settings, my assets, QR scan

[brightMedina5050]

Summary

This PR implements five features: roles admin UI, custom fields builder, developer settings, employee self-service portal, and QR scan landing page.

Changes

[FE-10] Roles & Permissions Admin UI

• Extended users page (/users) with activate/deactivate toggle per user
• Invite-user modal with email, name, and role selection
• Static role capabilities reference panel (Admin/Manager/Staff permissions)
• New API methods: toggleActive, inviteUser

[FE-11] Custom Fields Builder

• New /settings/custom-fields page with per-category field definitions
• Field types: text, number, date, select (with options), boolean
• Required flag, activate/deactivate (soft-delete), and hard delete
• Category sidebar for switching between asset categories

[FE-12] Developer Settings

• New /settings/developers page with API keys and webhooks panels
• API keys: create with name and scopes, show secret once with copy, revoke
• Webhooks: CRUD, signing secret display, test delivery button, delivery history
• Admin-only section

[FE-13] My Assets Employee Self-Service Portal

• New /my-assets page (default for STAFF role)
• Assigned assets list with photo, name, asset ID, condition, status
• Quick actions: Report Issue (creates maintenance request), Request Transfer
• My Requests tab showing transfer and maintenance request statuses

[FE-14] QR Scan Landing Page

• New /scan/[assetId] route (outside dashboard shell, mobile-first)
• Unauthenticated view: minimal safe info (name, photo, category, status, org)
• Authenticated view: quick actions (login, report issue)
• Unknown asset ID: branded not-found state

Verification

• All pages follow existing patterns (TanStack Query, typed API clients)
• Custom fields and developers settings integrate with existing settings page
• QR scan page is mobile-first and works outside the dashboard layout

Closes #1098
Closes #1099
Closes #1097
Closes #1096

[vercel]

@brightMedina5050 is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@brightMedina5050 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[yusuftomilola]

Reviewed. Solid additions:

• Users & Roles page: real invite-user flow and activate/deactivate with confirmation dialogs, admin-gated in the UI. I checked the current backend and confirmed PATCH /users/:id/active and POST /users/invite don't exist yet — these calls will 404 until the backend catches up, but that fails visibly (error surfaced in the modal), not silently, consistent with how search/reports in #1359 handle a not-yet-wired backend.
• QR scan landing page (/scan/:assetId): sensibly minimal public view (name, category, status, org contact) rather than leaking full asset details to an unauthenticated scanner — good privacy instinct.
• My Assets, Custom Fields, and Developer Settings (API keys/webhooks) pages are honestly local-state-only for now — no persistence and no fake success claims, so nothing here misleads a user about what's real.

Approving.