feat: role-scoped viewer tokens — restrict shared links to student or staff items

Add a Role scope dropdown to the Share modal (All roles / Ansatte / Elever).
Scope is stored as {"role": "student"|"staff"} in viewer_tokens.json and
enforced server-side in GET /api/db/flagged via session["viewer_scope"].
Client-side, #filterRole is pre-set and hidden for scoped viewers so the
constraint cannot be bypassed. Existing tokens and PIN sessions remain
unrestricted. Role badge shown on each scoped token row in the Active links list.

Files: app_config.py, routes/viewer.py, routes/database.py, gdpr_scanner.py,
templates/index.html, static/js/viewer.js, static/js/auth.js,
lang/en.json, lang/da.json, lang/de.json,
CLAUDE.md, CHANGELOG.md, README.md, MANUAL-EN.md, MANUAL-DA.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app_config.py

@@ -558,12 +558,14 @@ def _save_viewer_tokens(tokens: list) -> None:
         logger.error("[viewer_tokens] write failed: %s", e)
 
 
-def create_viewer_token(label: str = "", expires_days: int | None = None) -> dict:
+def create_viewer_token(label: str = "", expires_days: int | None = None, scope: dict | None = None) -> dict:
     """Generate a new viewer token, persist it, and return the token dict.
 
     Args:
-        label:       Human-readable description (e.g. "DPO review April 2026").
+        label:        Human-readable description (e.g. "DPO review April 2026").
         expires_days: Days until expiry.  None = no expiry.
+        scope:        Optional access scope, e.g. {"role": "student"} or {"role": "staff"}.
+                      Empty dict / None means unrestricted.
     """
     import secrets as _secrets
     token = _secrets.token_hex(32)   # 64-char URL-safe hex string
@@ -571,6 +573,7 @@ def create_viewer_token(label: str = "", expires_days: int | None = None) -> dic
     entry: dict = {
         "token":        token,
         "label":        label or "",
+        "scope":        scope or {},
         "created_at":   now,
         "expires_at":   now + expires_days * 86400 if expires_days else None,
         "last_used_at": None,