Summary

• generate a scannable QR code on the loopback-only /local-setup page when Quick Tunnel is ready
• keep the password outside the QR code and URL, with no third-party QR service
• preserve no-store, script-blocking CSP, and public-host 404 boundaries
• extend module and real Quick Tunnel smoke coverage for inactive and active pairing states
• update README, changelog, newcomer review, and manual verification contract

Verification

• npm.cmd run build:cli
• npm.cmd run build:frontend
• npm.cmd run verify:server-modules
• npm.cmd run verify:quick-tunnel
• node .\scripts\run-powershell-script.mjs .\scripts\verify-quick-tunnel.ps1
  • local setup 200
  • public-host setup 404
  • health/auth/WebSocket verification passed
  • QR present only after tunnel activation
  • tunnel stopped and orphan cloudflared count 0
• 393x852 browser smoke: 0 horizontal overflow, 220px QR
• OpenCV decoded the screenshot QR and matched the active publicUrl
• npm.cmd run verify:release (completed; existing App Server schema drift remains warn-only)
• npm.cmd run verify:governance
• git diff --check