Delivery: render a field's value as a QR code

Found by simulating a Claude Code build of Color Me Fun 2026 through the barako CLI (epic #801) on 14 September 2026; the event registration app for the Rotary Club of Koronadal is the acceptance test. Simulation page: https://claude.ai/code/artifact/05afda1a-6461-431d-aff0-50b30d3b0778

Color Me Fun's claim stub is a QR code a desk scans at kit pickup, encoding an unguessable token (CONTRACTS.md rule 3). Nothing in barakoCMS produces an image from a value.

## Change

`GET /api/public/{type}/{id}/qr/{field}` (or a delivery variant) renders a QR code for one field's value as PNG or SVG, only for a field the type marks as allowed to be encoded and only when the entry is readable by the caller. Also usable as an image source in generated documents (#585) and emails.

## Done when

- A confirmed registration's claim token renders as a QR code that decodes to the token.
- A field not allowed for QR, or an entry the caller cannot read, is a 404.

## Where it lives

Module: QR rendering is a small module, or part of the document generation module (#585). Delivery in the core does not gain an image renderer.

Start at the delivery entry point for GET /api/public/{type}/{id}/qr/{field}, then read CONTRACTS.md rule 3 and the document-generation work in #585 to understand allowed fields and readable entries. Done means a confirmed registration token decodes from the rendered PNG or SVG, while disallowed fields and unreadable entries return 404.

Written by the indexing model from the issue text.