qr-reader: register all server-language extensions (reader posts .jsp)

Hardware capture: the GEE/Fondvision reader (serial H05M2AFA) scans + sends +
beeps fine — the earlier 'no beep' was just nothing answering :3000. Real
request: GET /qa/mcardsea.jsp?cardid=...&cjihao=H05M2AFA&... — the 'server
language' setting (JSP here) selects the URL EXTENSION, so it posts .jsp, not
.php. Our route was .php-only and would have 404'd it.

Register the endpoint at php/jsp/asp/aspx/cgi so it works whatever the device is
configured to. cjihao (serial) is the lane key: assign the reader as
lane_devices.id = its serial.

apps/server/src/routes/qr-reader.ts

@@ -25,8 +25,6 @@ interface ReaderQuery {
   time?: string;
 }
 
-const SDK_PATH = "/qa/mcardsea.php";
-
 export async function qrReaderRoutes(app: FastifyInstance, dispatcher: ReadDispatcher): Promise<void> {
   // No auth: the reader is a machine on the isolated device subnet and offers no
   // auth on its side. Public route, like the Dingtian input push.
@@ -77,7 +75,13 @@ export async function qrReaderRoutes(app: FastifyInstance, dispatcher: ReadDispa
     };
   };
 
-  // The reader uses GET; accept POST too in case a variant differs.
-  app.get<{ Querystring: ReaderQuery }>(SDK_PATH, handler);
-  app.post<{ Querystring: ReaderQuery }>(SDK_PATH, handler);
+  // The reader's "server language" setting (JSP/PHP/C#/ASP/CGI) selects the URL
+  // EXTENSION it GETs — verified on hardware: a JSP-configured unit posts
+  // /qa/mcardsea.jsp. Register every extension so the endpoint works whatever the
+  // device is set to; accept POST too in case a variant differs.
+  for (const ext of ["php", "jsp", "asp", "aspx", "cgi"]) {
+    const path = `/qa/mcardsea.${ext}`;
+    app.get<{ Querystring: ReaderQuery }>(path, handler);
+    app.post<{ Querystring: ReaderQuery }>(path, handler);
+  }
 }