Non-shipping prototype of plans/active/2026-08-30-qr-code-login. The in-page "server"
runs the real grant state machine: two secrets (the QR's link_code can only approve;
the desktop-held poll_code is the only thing that can receive a session), single-use
consume, TTL expiry with auto-refresh, and a deny path. Scanning is simulated with a button —
in production the phone's real camera opens the URL via universal/app links.
The poll response set a normal session cookie —
same session semantics as phone login.