feat: add phone transfer QR flow

[leoncheng57]

Summary

• add a global Phone action that opens an accessible, responsive QR dialog without leaving the current page
• add PUBLIC_APP_URL as the single allow-listed public config value; it must be an HTTP(S) origin and falls back to the browser origin when unset
• generate the QR matrix entirely in the browser and render it as a React SVG path, so the target URL is never sent to a third-party QR or image service
• document Tailscale Serve setup and the pinned qrcode-generator@2.0.4 runtime dependency

Tests

• npm run typecheck
• npm test (104 passed)
• npm run build
• npm run test:e2e (59 passed)

Manual verification

1. Set PUBLIC_APP_URL to a phone-reachable Tailscale Serve HTTPS origin and restart the app.
2. Open any page and select Phone in the global navigation.
3. Confirm the displayed URL and QR target use the configured origin.
4. Verify Copy Link, Close, Escape dismissal, keyboard focus, and the 390px layout.
5. Unset PUBLIC_APP_URL, restart, and confirm the browser origin is used as the fallback.