/attendance/{session} binds its parameter to a uuid, so /attendance/scan
registered after it never matched: the wildcard took 'scan' first and died
casting it to a uuid — a 500, not a 404, so it did not look like a routing
problem at all.

Found by rendering the staff screens rather than by trusting that they route:
route:list sorts its output, so it showed the scanner sitting above the
wildcard when the file has it below. The list is not the matcher.

Adds the staff-screen smoke test that caught it, which also asserts a member
account is refused the approval queue and the scanner.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>