fix(api): add ttl_seconds to QR challenge response and fix client-side countdown

The QR login page countdown timer compared the server's UTC expiration
timestamp against the client's local clock, causing the QR code to appear
immediately expired when the client clock was ahead of the server.

Changes:
- Add ttl_seconds field to CreateChallengeResponse (seconds until expiry)
- Frontend countdown now uses relative elapsed time since response was
  received, eliminating clock-skew issues
- Mobile app: replace alert-only QR button with actual camera-based
  QR code scanner using expo-camera
- Add QRScannerScreen with barcode scanning, permission handling, and
  scan area overlay
- Update camera permission description to mention QR code scanning
- Add tests for ttl_seconds computation

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

tests/test_session_management.py

@@ -401,6 +401,35 @@ class TestQRLogin:
             expires = expires.replace(tzinfo=timezone.utc)
         assert expires > datetime.now(timezone.utc)
 
+    @patch("app.utils.session_manager.settings")
+    def test_create_qr_challenge_ttl_seconds(self, mock_settings, db_session: Session, sample_user_id: str):
+        """Test that ttl_seconds can be derived from created_at and expires_at.
+
+        The API endpoint computes ttl_seconds = (expires_at - created_at) to
+        allow the client to run a countdown timer without comparing absolute
+        timestamps (avoiding clock-skew issues).
+        """
+        from app.utils.session_manager import create_qr_challenge
+
+        mock_settings.qr_login_challenge_ttl_seconds = 120
+
+        challenge = create_qr_challenge(db_session, sample_user_id)
+
+        ttl_seconds = max(0, int((challenge.expires_at - challenge.created_at).total_seconds()))
+        assert ttl_seconds == 120
+
+    @patch("app.utils.session_manager.settings")
+    def test_create_qr_challenge_custom_ttl(self, mock_settings, db_session: Session, sample_user_id: str):
+        """Test that a custom TTL is correctly reflected in the challenge timestamps."""
+        from app.utils.session_manager import create_qr_challenge
+
+        mock_settings.qr_login_challenge_ttl_seconds = 300
+
+        challenge = create_qr_challenge(db_session, sample_user_id)
+
+        ttl_seconds = max(0, int((challenge.expires_at - challenge.created_at).total_seconds()))
+        assert ttl_seconds == 300
+
     @patch("app.utils.session_manager.settings")
     def test_validate_qr_challenge_valid(self, mock_settings, db_session: Session, sample_user_id: str):
         """Test validating a valid QR challenge."""