feat: expose push pairing QR endpoints

Return both JSON metadata and a PNG QR so clients can consume mobile pairing without rebuilding the payload themselves.