feat(scanner): add scanner category validation logic and related tests

tests/Feature/Ticket/ScannerTicketControllerTest.php

@@ -254,6 +254,52 @@ class ScannerTicketControllerTest extends TestCase
         $this->assertNull($ticket->fresh()->used_at);
     }
 
+    public function test_scanner_can_read_and_scan_any_category_when_tenant_disables_validation(): void
+    {
+        $this->tenant->update(['scanner_category_validation_enabled' => false]);
+        $this->scanner->scanCategories()->detach();
+        $otherCategory = Category::query()->create([
+            'tenant_code' => $this->tenant->codigo,
+            'nombre' => 'Comidas',
+        ]);
+        $ticket = $this->createTicket(
+            'aaaaaaaa-1111-4111-8111-aaaaaaaaaaaa',
+            [],
+            $otherCategory,
+        );
+        Sanctum::actingAs($this->scanner);
+
+        $this->getJson("/api/v1/scanner/tickets/{$ticket->ticket}")
+            ->assertOk()
+            ->assertJsonPath('data.id', $ticket->id);
+
+        $this->postJson("/api/v1/scanner/tickets/{$ticket->ticket}/scan")
+            ->assertOk()
+            ->assertJsonPath('data.scanner_user_id', $this->scanner->id);
+    }
+
+    public function test_disabled_category_validation_does_not_allow_scanning_another_tenant(): void
+    {
+        $this->tenant->update(['scanner_category_validation_enabled' => false]);
+        $otherTenant = $this->createTenant('other');
+        $foreignCategory = Category::query()->create([
+            'tenant_code' => $otherTenant->codigo,
+            'nombre' => 'Externas',
+        ]);
+        $foreignTicket = $this->createTicket(
+            'bbbbbbbb-1111-4111-8111-bbbbbbbbbbbb',
+            [],
+            $foreignCategory,
+            $otherTenant,
+        );
+        Sanctum::actingAs($this->scanner);
+
+        $this->getJson("/api/v1/scanner/tickets/{$foreignTicket->ticket}")
+            ->assertNotFound();
+        $this->postJson("/api/v1/scanner/tickets/{$foreignTicket->ticket}/scan")
+            ->assertNotFound();
+    }
+
     /** @param array<string, mixed> $attributes */
     private function createTicket(
         string $uuid,