Stage 3 — WO photos + ETA + QR + public tracking page

- HasMedia (Spatie) on WorkOrder with `photos` collection
- eta_at + tracking_token columns; token auto-generated on create
- Public /t/{token} page — tenant-scoped via subdomain, white-label themed
- QR code SVG via chillerlan/php-qrcode (inline modal + download)
- Filament: SpatieMediaLibraryFileUpload + ETA picker + tracking section
- EditWorkOrder header action "Link client (QR)" modal
- Fix: Auditable::dontSubmitEmptyLogs() → dontLogEmptyChanges() (removed in activitylog)
- Tests: TrackingPageTest (4 pass) covering token gen + cross-tenant isolation

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

routes/web.php

@@ -57,6 +57,14 @@ Route::get('/login', function (Request $request) {
     return redirect($tenant ? '/app/login' : '/admin/login');
 })->name('login');
 
+// ─── Public WO tracking (no auth, tenant-scoped via subdomain) ──────
+Route::get('/t/{token}', [\App\Http\Controllers\TrackingController::class, 'show'])
+    ->where('token', '[A-Za-z0-9]{16,32}')
+    ->name('tracking.show');
+Route::get('/t/{token}/qr.svg', [\App\Http\Controllers\TrackingController::class, 'qr'])
+    ->where('token', '[A-Za-z0-9]{16,32}')
+    ->name('tracking.qr');
+
 // Locale switch — POST /locale/{lang} sets session and persists to user.
 Route::post('/locale/{lang}', function (Request $request, string $lang) {
     if (! in_array($lang, ['ro', 'ru', 'en'], true)) {