0.1.4

Fixes

• Coerce content query input on the public QrCode/QrCode/image and Admin/QrCode/image actions before any string operation. Previously getQuery('content') returned mixed and was passed straight to strlen() / formatText(string) — a crafted ?content[]=foo against the public unauthenticated route raised an uncaught TypeError. Both actions now throw BadRequestException on missing/array/overlong input. The 2953-byte cap is hoisted into a MAX_CONTENT_LENGTH constant, and the Admin/QrCode/index POST branch applies the same is_string + length cap so the helper cannot be asked to render multi-megabyte payloads via the form.
• Centralize MECARD escaping in Formatter::formatCard. Every scalar field (name, nickname, sound, note, tel, video, address, org, role, email, url) now routes through a single escapeMecard helper that escapes \, ;, :, ,, CR and LF in spec order. Previously only note was partially escaped, so a single ; in any other field truncated the rest of the MECARD payload at the scanner.

Improvements

• Switched the 3 admin-template __() calls to __d('qrcode', ...) so plugin strings live in their own i18n domain instead of leaking into the host app's default domain. Added resources/locales/qrcode.pot (3 unique msgids) so language packs can be derived from a stable POT.

Full Changelog: 0.1.3...0.1.4