Your ID Scanner Might Be a Lawsuit: Dispensary Biometrics After the 2026 BIPA Ruling