qr-reader: register all server-language extensions (reader posts .jsp)

Hardware capture: the GEE/Fondvision reader (serial H05M2AFA) scans + sends +
beeps fine — the earlier 'no beep' was just nothing answering :3000. Real
request: GET /qa/mcardsea.jsp?cardid=...&cjihao=H05M2AFA&... — the 'server
language' setting (JSP here) selects the URL EXTENSION, so it posts .jsp, not
.php. Our route was .php-only and would have 404'd it.

Register the endpoint at php/jsp/asp/aspx/cgi so it works whatever the device is
configured to. cjihao (serial) is the lane key: assign the reader as
lane_devices.id = its serial.

wiki/log.md

@@ -656,3 +656,15 @@ guarantee. Recorded in [[dingtian-relay]] (new Hardening section).
 - VERIFIED via inject: valid permit QR→status:1+open; re-scan→permit exit; unknown→status:0; reader
   on barrier-less lane→status:0. Full build 5/5.
 - Updated [[gee-qr-er80]] (endpoint as-built + hardware open items).
+
+## [2026-06-16] test+fix | QR reader VERIFIED on hardware; path is .jsp not .php
+- Ran a verbatim-vendor logger on :3000 (replies like mcardsea.php: status:0/output:2). Reader
+  **beeped** → it scans, sends, and acts on the reply. Earlier "no beep" = nothing was answering :3000.
+- Real GET captured: `/qa/mcardsea.jsp?cardid=52020056&mjihao=1&cjihao=H05M2AFA&status=11&time=...`
+  from 10.0.10.7 (OEM = Fondvision, per referer).
+- KEY FIX: the "server language" setting selects the URL EXTENSION — this unit is JSP → posts
+  **`.jsp`**, but our route was `.php` only (would 404 the reader). Route now registers
+  php/jsp/asp/aspx/cgi. Build green.
+- Real serial **cjihao=H05M2AFA** = the lane key → assign reader as lane_devices.id="H05M2AFA".
+  Reader beeped on status:0 (invalid/1-beep); a matching permit/session → status:1 (2-beep accept).
+- Updated [[gee-qr-er80]] (verified-on-hardware).