feat(go): M6.6 — /qr, /sync-bank, /flush-cache, /version pages

- GET /qr: Czech QR Platba PNG; ports Python qr_code() exactly
  (account validation, amount clamping, * stripping, SPD format)
- GET /sync-bank: Fio sync → infer → cache flush with captured log
- GET+POST /flush-cache: form + action, shows deleted count
- GET /version: JSON alias of /api/version (Python parity)
- FlushCache() added to membership.Sources; wired through api.Handler
- web.ActionHandlers{BankSync} closure-based dep injection for sync
- New dep: github.com/skip2/go-qrcode
- TestQRBuildSPD (9 cases), TestServeQR, TestServeFlushCache{GET,POST},
  TestServeSync, TestServeVersion added

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md

@@ -115,7 +115,7 @@ Goal: feature-equivalent UX on the Go side, designed cleanly. Not a Jinja port.
 - [x] **M6.3** `/juniors` page: same structure + per-month J/A attendance breakdown + `"?"` sentinel rendering — `9564103`
 - [x] **M6.4** `/payments` page: grouped-by-person ledger view — `689f1c0`
 - [x] **M6.5** Modal JS module (`static/js/member-detail.js`): fetches `/api/adults` (or juniors), renders status/exceptions/transactions on row click; keyboard nav (Esc, ↑/↓) — `e53e238`
-- [ ] **M6.6** `/qr`, `/sync-bank`, `/flush-cache`, `/version` pages
+- [x] **M6.6** `/qr`, `/sync-bank`, `/flush-cache`, `/version` pages
 - [ ] **M6.7** Wire `embed.FS` into handlers; verify single-binary deployment includes all assets
 
 **Gate:** Browser smoke on :8080: all pages render, name+month filters work, modal opens with correct data, QR loads, sync/flush work end-to-end.