[Frontend] Use opaque identifiers in public QR URLs

## Problem

Predictable record or pet IDs make public emergency profiles enumerable.

## Relevant code

`src/pages/qrcode.tsx, src/pages/scan/[id].tsx`

## Proposed scope

Generate high-entropy revocable tag IDs, avoid exposing internal IDs, and add enumeration/throttling tests.

## Acceptance criteria

- [ ] The reported behavior is reproduced or characterized with a focused automated test before the fix.
- [ ] The implementation satisfies the proposed scope without weakening TypeScript, lint, authorization, privacy, or error handling.
- [ ] Success, empty/loading where applicable, failure, and boundary cases are covered.
- [ ] Existing related tests pass and new regression coverage is included.
- [ ] User-facing behavior remains accessible by keyboard and at mobile viewport sizes where UI is affected.
- [ ] Documentation is updated when the change alters configuration, contracts, security assumptions, or contributor workflow.

## Contributor notes

Base the work on the latest `main` branch. Keep unrelated refactors out of the pull request and include screenshots or recordings for visible changes. Never use real pet, medical, contact, wallet, or credential data in fixtures.

Start in src/pages/qrcode.tsx and src/pages/scan/[id].tsx, and reproduce the identifier-enumeration behavior with a focused automated test. Trace how public QR URLs are generated and resolved, then verify opaque revocable IDs, enumeration/throttling coverage, authorization, privacy, error handling, and success, empty/loading, failure, and boundary cases. Run the existing related tests and add regression coverage without using real personal data.

Written by the indexing model from the issue text.