### Resolve a subscriber by scan code

`GET /api/v1/users/resolve`

Exchanges the opaque per-subscriber scan token, the one encoded in a printed QR code, for the subscriber record. Scoped to the caller's subtree exactly like a direct fetch.

- Authentication: manager session (JWT) or API token
- Permission: `prm_users_index` (View users)
- Risk: read
- Rate limit bucket: `user_resolve`

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `code` | query | string | yes | The scan token. The QR payload is prefixed with xr:u: — strip the prefix before sending. |

#### Errors

| Code | Status | When |
| --- | --- | --- |
| `ERR_VALIDATION` | 400 | code is missing or blank |
| `ERR_NOT_FOUND` | 404 | no subscriber carries that token, or they are outside the caller's subtree |