fix: prevent duplicate prompt dispatch from QR pick polling

Use a ref-based guard (pickedRef) to ensure sendPrompt is called
exactly once, regardless of effect re-runs or in-flight fetch races.
Also generate a fresh session ID each time the modal opens.