Add clinical device registry, browser wedge scan, and local agent API.

Branch-scoped Care devices with hashed agent tokens, patient barcode lookup/labels, and provenance-aware vitals from a minimal device agent (Pro for agent hardware; wedge free).

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Middleware/AuthenticateCareDevice.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\Care\DeviceService;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class AuthenticateCareDevice
+{
+    public function __construct(
+        protected DeviceService $devices,
+    ) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        $token = $this->extractToken($request);
+
+        abort_unless(is_string($token) && $token !== '', 401, 'Device token required.');
+
+        $device = $this->devices->findByToken($token);
+        abort_unless($device, 401, 'Invalid device token.');
+
+        $request->attributes->set('care.device', $device);
+
+        return $next($request);
+    }
+
+    protected function extractToken(Request $request): ?string
+    {
+        $header = $request->header('X-Care-Device-Token');
+        if (is_string($header) && $header !== '') {
+            return $header;
+        }
+
+        // Compatibility with Frontdesk-style header.
+        $legacy = $request->header('X-Device-Token');
+        if (is_string($legacy) && $legacy !== '') {
+            return $legacy;
+        }
+
+        $bearer = $request->bearerToken();
+        if (is_string($bearer) && $bearer !== '') {
+            return $bearer;
+        }
+
+        $input = $request->input('token');
+
+        return is_string($input) && $input !== '' ? $input : null;
+    }
+}