feat(go): M6.6 — /qr, /sync-bank, /flush-cache, /version pages

- GET /qr: Czech QR Platba PNG; ports Python qr_code() exactly
  (account validation, amount clamping, * stripping, SPD format)
- GET /sync-bank: Fio sync → infer → cache flush with captured log
- GET+POST /flush-cache: form + action, shows deleted count
- GET /version: JSON alias of /api/version (Python parity)
- FlushCache() added to membership.Sources; wired through api.Handler
- web.ActionHandlers{BankSync} closure-based dep injection for sync
- New dep: github.com/skip2/go-qrcode
- TestQRBuildSPD (9 cases), TestServeQR, TestServeFlushCache{GET,POST},
  TestServeSync, TestServeVersion added

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

go/internal/web/render.go

@@ -37,6 +37,20 @@ type PaymentsPageData struct {
 	Error string
 }
 
+// SyncPageData is the view model for the /sync-bank HTML page.
+type SyncPageData struct {
+	PageData
+	Output  string
+	Success bool
+}
+
+// FlushPageData is the view model for the /flush-cache HTML page.
+type FlushPageData struct {
+	PageData
+	Flushed bool
+	Deleted int
+}
+
 // Renderer parses and executes HTML templates from the embedded FS.
 type Renderer struct {
 	tmpls map[string]*template.Template