Public lab QR status update

# Lab update QR

Some orders expose lab-update public link for external labs to post status without staff credentials.

Protect QR links — treat like temporary secrets.